Technical impact
Improper neutralization of input during web page generation (CWE‑79) in Gemini Labs Site Reviews allows a stored cross‑site scripting flaw. An attacker can embed malicious script into a review that is then rendered and executed in the browsers of visitors that view the review, potentially leading to defacement, cookie theft, or arbitrary client‑side code execution.
Affected Systems
Gemini Labs’ Site Reviews plugin for WordPress is affected. All WordPress installations that use Site Reviews version 8.2.0 or any earlier release are vulnerable.
Risk and Exploitability
The flaw has a CVSS score of 7.1, indicating high severity. The EPSS score is below 1%, showing a very low but non‑zero likelihood of exploitation. The flaw is not listed in CISA’s KEV. Exploitation would require an attacker to provide a malicious review via the plugin’s input fields or craft a URL that triggers the plugin’s rendering of the stored data. It is inferred that an attacker could trigger the flaw by submitting a malicious review or creating a link that displays stored data. Based on the description, it is inferred that an attacker does not need authentication or special privileges on the host to exploit the stored XSS, as the vulnerability is triggered by unfiltered content being rendered in the victim’s browser.
