The vulnerability resides in the Verified Reviews (Avis Vérifiés) plugin for WordPress and allows unauthenticated attackers to store malicious web scripts via the "moderation" parameter. The plugin’s input validation fails because the ntav_check_data() function compares signature values loosely, enabling a JSON body with boolean true for idWebsite and sign to bypass authentication. When the stored script is rendered on a page, it executes in the victim’s browser. Based on the typical impact of stored XSS, attackers could potentially steal cookies, hijack sessions, or exfiltrate data; these actions are inferred from the description and not directly stated in the input.

All WordPress sites running the Verified Reviews (Avis Vérifiés) plugin version 2.4.6 or earlier are affected. The vulnerability affects every installation that utilizes the plugin’s moderation feature, regardless of other security configurations.

The CVSS score of 7.2 indicates a high severity. The EPSS score is reported as < 1 %, implying that, at present, the likelihood of widespread exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is entirely unauthenticated: an attacker only needs to craft a JSON request to the moderation endpoint; no credentials are required. Because the flaw allows arbitrary script injection, exploitation is straightforward if the attacker can reach the endpoint through network access to the WordPress site.