The WP Yelp Review Slider plugin processes Yelp review text during the import operation without proper sanitization or escaping, allowing an attacker to embed malicious JavaScript into the review content. The script is persisted in the WordPress database and then rendered when a visitor loads a review page, resulting in a stored cross‑site scripting (XSS) flaw that can alter page behavior or execute arbitrary code in the context of the site visitor.

All installations of the jgwhite33 WP Yelp Review Slider plugin on a WordPress site running version 9.2 or earlier are affected. The vulnerability exists in every release up to and including 9.2 because the import routine relies on the wpyelp_download_source function without validating or sanitizing the review text.

The CVSS base score of 7.2 indicates a high severity. Attackers need no authentication and can trigger the flaw by having a malicious Yelp review imported or by leaving crafted content via the review download feature. The EPSS score is not available, but given the plugin’s typical use case and lack of authentication requirements, exploitation is likely if an attacker can influence review content. The vulnerability is not listed in the CISA KEV catalog.