Gemini Labs Site Reviews contains an improper neutralization of input during web page generation that allows an attacker to store malicious scripts in reviews. The vulnerability can lead to client‑side code execution in browsers of site visitors, enabling a range of malicious actions. The weakness is a classic stored XSS flaw (CWE‑79).

The Gemini Labs Site Reviews WordPress plugin, versions up to and including 8.3.5, is impacted. Any installation using these versions retains the vulnerability until upgraded.

The CVSS score of 6.5 classifies the issue as a medium severity risk. EPSS data is currently unavailable, and the vulnerability is not listed in CISA KEV, suggesting limited publicly available exploitation. Based on the description, the attack vector is likely through a review submission where an attacker inputs malicious code that is subsequently rendered to site visitors. Successful exploitation would require the attacker to post a crafted review, after which any visitor to that review would execute the injected script. While no advanced prerequisites are noted, the widespread use of the plugin increases exposure potential.