CVE-2025-5845 is a stored cross-site scripting vulnerability in the wpchop Affiliate Reviews plugin for WordPress. The issue exists in all versions up to and including 1.0.6, where the 'numColumns' parameter is not properly sanitized or escaped before being rendered in web pages. This allows authenticated attackers with Contributor-level privileges or above to inject arbitrary JavaScript code that executes in the context of other users viewing the compromised pages.

Successful exploitation can lead to the execution of arbitrary scripts in the browsers of users who visit the injected pages. This may result in limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and requiring privileges of a Contributor or higher. There is no indication of availability impact or known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Affiliate Reviews plugin if possible to reduce exposure.