The SIP Reviews Shortcode for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-89) in the 'no_of_reviews' attribute of the woocommerce_reviews shortcode. Authenticated users with contributor or higher privileges can inject malicious scripts because the plugin does not properly sanitize or escape this attribute. This vulnerability affects all versions up to and including 1.2.3. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode attribute. These scripts execute in the context of any user viewing the affected page, potentially leading to theft of session cookies, defacement, or other malicious actions impacting confidentiality and integrity. There is no direct availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, restrict contributor-level access where possible and consider removing or disabling the vulnerable shortcode to mitigate risk.