The vulnerability is a stored cross‑site scripting flaw in the wp_display shortcode handler of the Reviews and Rating – Google Reviews plugin. It allows an attacker who can inject content via the shortcodes to supply an attacker‑controlled "html_tags" value. The handler then embeds untrusted content inside raw HTML tags, permitting arbitrary JavaScript to be stored in the site database. When any user views a page containing the injected shortcode, the malicious script runs in that user’s browser, potentially stealing credentials, hijacking sessions, or defacing the site. This issue is due to improper input validation and is classified as CWE‑79.

The affected product is the WordPress plugin Reviews and Rating – Google Reviews from designextreme. All releases up to and including version 5.10 are vulnerable. No other vendor or product is listed as impacted.

With a CVSS score of 6.4 the flaw is moderately severe. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with Contributor or higher role to inject content. Once injected, the malicious script executes for every site visitor who accesses a page containing the shortcode, giving the attacker widespread reach across the site’s user base.