An Improper Neutralization of Input During Web Page Generation flaw exists in the AMP‑MODE: Review Disclaimer WordPress plugin, which allows stored Cross‑Site Scripting (XSS). The vulnerability permits malicious JavaScript to be embedded in content that is later rendered by the plugin, causing the script to run in the browsers of anyone who views the affected pages.

The AMP‑MODE: Review Disclaimer plugin is affected for every release up to and including version 2.0.3. WordPress sites that have installed the plugin with those or earlier versions are therefore vulnerable.

The CVSS score of 5.9 marks this as a medium severity issue, while an EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to submit malicious input through the plugin’s data entry points—such as review fields or configuration panels—which is later displayed without adequate sanitization, leading to script execution in the context of site visitors. This inference is derived from the nature of stored XSS and is not explicitly stated in the CVE description.