This vulnerability arises from an improper neutralization of user input in the WP TripAdvisor Review Slider plugin, allowing malicious JavaScript to be stored in the database and rendered in web pages for all site visitors. The stored XSS can result in session hijacking, credential theft, defacement, or other malicious activity executed in the context of a legitimate user’s browser, compromising confidentiality, integrity, and availability of the site’s content.

WordPress installations that have the jgwhite33 WP TripAdvisor Review Slider plugin installed in any version up to and including 14.1 are affected. Sites that rely on the plugin to display user reviews or ratings without upgrading past 14.1 expose themselves to this risk.

The CVSS score of 6.5 reflects moderate severity. Exploitation requires the ability to submit or edit review content that the plugin stores. Based on the description, it is inferred that attackers could exploit the plugin by accessing the review submission or editing interfaces to inject JavaScript. The lack of an EPSS score and absence from the KEV catalog suggest that active exploitation is not yet documented, but the vulnerability remains a realistic threat to sites that publicly display reviews and may have users with contributor or administrative privileges.