CVE-2025-4170 is a stored cross-site scripting vulnerability in the Xavin's Review Ratings WordPress plugin (up to version 1.4.0). It occurs due to improper neutralization of input during web page generation, specifically in the 'xrr' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can inject arbitrary scripts that execute when the page is viewed, potentially impacting confidentiality and integrity of user data.

The vulnerability allows authenticated users with contributor-level access or above to inject malicious scripts into pages via the 'xrr' shortcode. When other users access these pages, the injected scripts execute, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS score of 6.4 reflects a medium impact on confidentiality and integrity, with no impact on availability. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Xavin's Review Ratings plugin if feasible to mitigate risk.