This vulnerability results from improper neutralization of user input in the JetReviews plugin, enabling attackers to embed malicious JavaScript that is stored and later served to other site visitors. Such a stored cross‑site scripting flaw can compromise user credentials, deface the site, or redirect users to malicious destinations. The weakness is a classic input validation issue (CWE‑79).

The issue affects the WordPress JetReviews plugin from the earliest revision through version 3.1.2. Users running any of these versions on WordPress sites are exposed to the flaw. The vendor, Crocoblock, issues the plugin as JetReviews.

The CVSS score is 6.5, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. Because the flaw is a stored XSS, the likely attack vector involves an attacker submitting crafted content via the plugin’s review input fields, which is later rendered on pages accessed by other users. Successful exploitation would require the attacker to persuade or trick users—to visit the affected pages—to execute the injected script. Given the moderate score and the lack of public exploitation, the risk is present but not imminent, yet it is still advisable to remediate promptly.