The Nearby Now Reviews WordPress plugin accepts a shortcode attribute named data_tech that is stored without proper sanitization or escaping. Authenticated users with the Contributor role or higher can supply arbitrary script content in this attribute, which is later rendered in other site pages. An attacker can inject malicious JavaScript that executes in the browsers of visitors to those pages, potentially enabling cookie theft, session hijacking, defacement, or the execution of arbitrary actions on behalf of the user. The weakness is an example of input handling flaw (CWE‑79).

The vulnerability exists in all releases of the Nearby Now Reviews plugin from the vendor lnbadmin1 up to and including version 5.2. No later releases are affected according to the current data.

The CVSS score of 6.4 indicates a moderate severity. The EPSS probability is less than 1 %, which suggests that exploitation is unlikely but not impossible. The issue is not listed in the CISA KEV catalog. Because the flaw requires an authenticated account with Contributor-level privileges, an attacker must first compromise or impersonate a legitimate user with sufficient rights to inject the payload. Once the payload is stored, it will execute for any visitor of the affected page, creating a persistent threat in the environment.