The vulnerability resides in the xrr shortcode of Xavin's Review Ratings, where user supplied attributes are neither sanitized nor escaped. A contributor or higher user can place script code in these attributes, resulting in stored XSS that will execute in a visitor's browser whenever the content is displayed. This allows an attacker to run arbitrary client‑side code, potentially compromising user credentials, hijacking sessions, or defacing the site. The weakness is identified as CWE‑79.

All installations of the Xavin's Review Ratings plugin for WordPress with version 1.4.0 or earlier are affected. The plugin is available from the WordPress repository and can be found under the vendor name xavinnydek within the WordPress plugin ecosystem.

The CVSS score of 6.4 indicates moderate severity; the EPSS score of less than 1% reflects a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The required attack conditions include an authenticated WordPress session with at least contributor‑level permissions, giving attackers the ability to modify plugin content where the shortcode is used. Once injected, the malicious script runs in the context of any user who visits the impacted page.