Skip to content
PluginCanary

YASR

YASR - Yet Another Star Rating Plugin for WordPress
by Dash Labs · 10,000+ active installs · Checked 4 Nov 2026
Watch2 Warnings

Watch: tested up to WordPress 6.8.12, 3 major versions behind 7.1.4.

70/ 100 Canary Score
Sub-scores for YASR
Ownership100
Maintenance20
Security95
SupportNo data
ReputationNo data

How the score works

Quick answers

Is YASR still maintained?
No. Last release 10 Apr 2025, over 1 year ago. 10 Apr 2025 · wordpress.org
Who owns YASR, and has it changed hands?
No change recorded. Main committer paretodigital since Aug 2023. 4 Nov 2026 · SVN log
Was YASR removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is YASR safe?
9 known vulnerabilities, all fixed (latest in 3.4.15). Not on the exploited list. 30 Apr 2026 · Wordfence Intelligence
Is the latest YASR update safe to install?
No ownership change before 3.4.15. No one-star spike after it. 10 Apr 2025 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningMNT-2Tested up to WordPress 6.8.12, 3 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
  • WarningMNT-1No release in 19 months (last release 10 Apr 2025). Plan a replacement if the plugin is important to your site.10 Apr 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Dudo4 Jun 2014 to 14 Aug 2023, 880 commits
paretodigital18 Aug 2023 to 10 Apr 2025, 44 commits

2 committers recorded. No ownership change since 2014.

Maintenance

Last release
19 months ago
Releases, 24 months
2
Tested up to
6.8 vs 7.1
Requires PHP
5.4 supported 8.2+
Releases per quarter
Releases per quarter for YASR
Q1 20242
Q2 20242
Q3 20240
Q4 20241
Q1 20251
Q2 20251
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

Last release 10 Apr 2025. Tested up to 6.8, 3 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.7.

Average rating per quarter for YASR
Q4 20235.0
Q1 20244.0
Q2 20245.0
Q1 20255.0
Q4 20252.5
Q1 20265.0

Average rating stayed at 5.0 between Q4 2023 and Q1 2026.

Rating distribution
5 star283
4 star11
3 star6
2 star6
1 star17
Latest low reviews

Security record

1 vulnerability in 24 months (9 on record), patched (latest fixed in 3.4.15).

Show 9 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Apr 2026Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter6.1<= 3.4.123.4.15Patched before disclosure
27 Nov 2023Yet Another Stars Rating <= 3.4.3 - Missing Authorization via init5.3<= 3.4.33.4.4Patched before disclosure
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.11.4.4 to 3.4.13.4.2Patched before disclosure
10 Jul 2023Yet Another Stars Rating <= 3.3.8 - Missing Authorization to Vote Tampering5.3<= 3.3.83.3.9Patched before disclosure
3 Mar 2023Yet Another Stars Rating <= 3.1.2 - Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes6.4<= 3.1.23.1.3Patched before disclosure
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 2.0.22.0.2Patched before disclosure
3 Feb 2022Yasr - Yet Another Stars Rating <= 2.9.9 - Cross-Site Scripting via source4.7<= 2.9.93.0.0Patched before disclosure
27 Jan 2019Yet Another Stars Rating <= 1.8.6 - Unauthenticated PHP Object Injection9.8<= 1.8.61.8.7936
6 Jul 2015Yasr - Yet Another Stars Rating < 0.9.1 - Authenticated SQL Injection8.8< 0.9.10.9.11333

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for YASR
4 May 2026123
11 May 2026277
18 May 2026204
25 May 2026182
1 Jun 2026200
8 Jun 2026294
15 Jun 2026265
22 Jun 2026187
29 Jun 2026197
6 Jul 2026200
13 Jul 2026173
20 Jul 2026225
27 Jul 2026244
3 Aug 2026236
10 Aug 2026205
17 Aug 2026219
24 Aug 2026189
31 Aug 2026207
7 Sep 2026245
14 Sep 2026253
21 Sep 2026308
28 Sep 2026273
5 Oct 2026416
12 Oct 2026387
19 Oct 2026427
26 Oct 2026467
2 Nov 202675

Weekly downloads over the last 4 weeks are 37% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

WP-PostRatingsScore 100 · 20,000+kk Star RatingsScore 95 · 70,000+Rate My PostScore 94 · 20,000+WP ULikeScore 90 · 60,000+

Facts

Version3.4.15
AuthorDash Labs
Added4 Jun 2014
Last updated10 Apr 2025
Active installs10,000+
Requires WordPress4.7
Tested up to6.8.12
Requires PHP5.4
CategoryE-commerce & Shopping
Tagsblock, rating, rate post, star rating, google rating

Questions

Is YASR still maintained?

No. Last release 10 Apr 2025, over 1 year ago.

Who owns YASR, and has it changed hands?

No change recorded. Main committer paretodigital since Aug 2023.

Was YASR removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is YASR safe?

9 known vulnerabilities, all fixed (latest in 3.4.15). Not on the exploited list.

Is the latest YASR update safe to install?

No ownership change before 3.4.15. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue