The Social Reviews & Recommendations WordPress plugin (widgetpack Reviews Widgets for Google, Yelp & TripAdvisor) suffers from a stored cross-site scripting vulnerability (CWE-79) in the 'trim_text' function. This flaw arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to inject arbitrary scripts that execute in users' browsers when they visit compromised pages. The issue affects all versions up to and including 2.5. Although version 2.5 includes a partial patch, the vulnerability is not fully resolved. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating network exploitable, low attack complexity, no privileges or user interaction required, with impact on confidentiality and integrity but no availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected website, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity of user data. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

A partial patch was introduced in version 2.5 of the plugin; however, no complete fix is confirmed. Since no official full patch or vendor advisory is provided, users should monitor for updates from the vendor and apply them promptly once available. Until a full fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.