The vulnerability arises from improper neutralization of input during web page generation, allowing reflected XSS through the review submission form in the Photo Reviews for WooCommerce plugin. An attacker can inject malicious scripts that execute in the browsers of users who view the affected pages, potentially leading to session hijacking, credential theft, or defacement. The flaw is a classic Reflected XSS identified as CWE‑79.

The issue affects the VillaTheme Photo Reviews for WooCommerce plugin for all versions from the earliest release through 1.2.30. Users who have not updated to the patched version 1.2.31 or later are vulnerable.

The plugin’s description does not provide a specific attack vector, but based on the nature of reflected XSS it is inferred that the attacker needs to convince an end‑user to visit a crafted URL or submit a review containing script payloads. The CVSS score is 7.1, indicating high criticality, and the EPSS score is not available, so exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploits at this time.