The Rich Showcase for Google Reviews plugin for WordPress suffers from a stored cross‑site scripting flaw in all versions up to and including 6.9.9. The vulnerability arises because the plugin does not properly sanitize or escape the value supplied to the 'pagination' shortcode attribute. An attacker with contributor‑level or higher privileges can supply a malicious script that is then stored in the database and executed in the browsers of any user who views a page using that shortcode. The exploit gives an attacker the ability to run arbitrary client‑side code, enabling phishing, cookie theft, defacement, or further compromise of the site.

WordPress sites that have installed the Rich Showcase for Google Reviews plugin at any version 6.9.9 or older are affected. The vulnerability impacts any site where authenticated users with contributor rights can insert or modify the 'pagination' shortcode. Version information is explicitly noted as all releases up to 6.9.9.

The CVSS base score is 6.4, reflecting moderate severity. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation observed in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Attackers require authentication and a contributor or higher role; therefore, the exploit is limited to trusted users on the site. If these conditions are met, the attacker can inject persistent scripts that will run in the browsers of all users who view the affected content.