The Social Reviews & Recommendations plugin for WordPress contains a stored cross‑site scripting vulnerability in the trim_text function that fails to properly sanitize or escape user input across all versions up to and including 2.5. An attacker can place malicious JavaScript into fields that are subsequently rendered within review widgets, causing the script to execute in the browsers of any visitor who views the compromised review. This can lead to theft of credentials, session hijacking, defacement or delivery of other malicious payloads, as defined by CWE‑79.

WordPress sites that are running the Social Reviews & Recommendations plugin version 2.5 or earlier from the vendor widgetpack, specifically the Reviews Widgets for Google, Yelp & TripAdvisor. No information is available for versions beyond 2.5, so any deployment of 2.5 or lower is considered affected.

The CVSS score of 7.2 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, indicating no large‑scale attacks have been observed. Based on the description, the attack vector is inferred to be through the review submission interface or the WordPress admin panel where the ‘trim_text’ parameters are accepted. Once stored, the payload persists until the plugin is upgraded or removed.