The Reviews Widgets for Google, Yelp & TripAdvisor WordPress plugin contains a flaw that allows an authenticated user with Contributor or higher permissions to store a malicious script within the 'page_id' attribute of the [fbrev] shortcode. The attribute value is not sanitized or escaped before it is rendered, so the injected code is written into the page’s HTML and executed automatically whenever a visitor loads a page that contains the shortcode. This weakness is identified as CWE‑79 and enables attackers to inject and run arbitrary JavaScript on the site’s front end.

WordPress sites that have the Reviews Widgets for Google, Yelp & TripAdvisor plugin installed. All releases up to and including version 2.7.3 are affected. Any WordPress installation that accepts the [fbrev] shortcode with a 'page_id' attribute is susceptible.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Exploitation requires authentication; a user with Contributor level or higher can inject the payload through the WordPress editor. Once stored, the malicious script is served to any visitor who views the affected page, allowing the attacker to execute front‑end JavaScript in the victims’ browsers.