The Widgets for Google Reviews plugin for WordPress allows an authenticated user with contributor-level access to store malicious JavaScript via the plugin's trustindex shortcode. The flaw results from insufficient input sanitization and inadequate output escaping on user supplied attributes, enabling the injection of arbitrary scripts that execute when a page containing the shortcode is rendered. This constitutes a Stored Cross‑Site Scripting vulnerability (CWE‑79).

Vulnerable versions of the widget range from the earliest release up through 13.2.1, affecting all WordPress sites that have not upgraded past that point. The plugin, produced by trustindex, is available from the WordPress Plugin Repository and commonly used to display Google Reviews.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Because the flaw requires authentication and sufficient privileges, an attacker would first need to compromise a contributor or higher account or leverage a pre‑existing account, and then craft a malicious shortcode that is stored and later rendered to any visitor. Despite the low EPSS, the potential impact on any user who views affected pages warrants rapid patching; the vulnerability is not currently listed in the CISA KEV catalog.