The Reviews Feed WordPress plugin, when installed in a version prior to 2.6.5, renders third‑party review content through a dynamic block without sanitizing any embedded WordPress shortcodes. This shortfall allows an unauthenticated attacker to plant a shortcode in a review that originates from a connected source such as Google Reviews, and when the feed is displayed on a site, the shortcode is executed within the context of the website. The flaw is identified as CWE‑345: Insufficient Filtering for Print‑facing Output, and can lead to the injection and execution of arbitrary code on the front‑end, potentially compromising site integrity and confidentiality.

Any installation of the Reviews Feed plugin that is older than version 2.6.5 is susceptible. The vulnerability exists regardless of the underlying WordPress version or other plugins, provided the feed is active and configured to pull reviews from an external source. Site administrators should verify their plugin version and assess whether third‑party review sources can be manipulated to contain malicious shortcodes.

The CVSS score of 4.8 denotes moderate severity, while the EPSS score of less than 1% indicates very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. An attacker needs no authentication or elevated privileges; simply injecting a shortcode into an external review suffices. Successful exploitation would grant arbitrary code execution on the website's front‑end, potentially enabling the attacker to inject malicious scripts or compromise user data. Detection may be delayed because the issue resides in data imported from a third‑party source rather than direct user input.