The Repuso Reviews Widgets plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its 'rw_image_badge1' shortcode. This vulnerability arises because the plugin does not properly sanitize or escape user input in shortcode attributes, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. When other users visit pages containing the injected shortcode, the malicious scripts execute, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 5.20. No vendor advisory or patch is currently available, and the plugin is not a cloud service, so remediation depends on vendor action or user mitigation.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users viewing the affected pages, potentially leading to theft of sensitive information, session tokens, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity of user data. The CVSS 3.1 base score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required for exploitation beyond contributor access, no user interaction needed, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only to reduce risk. Consider disabling or removing the vulnerable shortcode if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.