The vulnerability allows unauthenticated attackers to inject malicious scripts into pages served by the Site Reviews plugin, enabling the execution of arbitrary JavaScript in the context of a visitor’s browser. This flaw, classified as CWE‑79, can be used for defacement, credential theft, or other malicious actions that compromise the confidentiality and integrity of user sessions.

Gemini Labs’ Site Reviews plugin, all releases up to and including 8.3.1, is affected. The issue is present in any WordPress installation that has not yet upgraded beyond version 8.3.1.

The flaw carries a CVSS score of 7.1, indicating moderate to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the attack requires no authentication and can be triggered simply by visiting a page that displays user‑generated content, the likelihood of exploitation remains significant for public sites. Overall, the risk to affected sites is substantial, especially if the plugin is exposed to guest users or untrusted review submissions.