The WP Ultimate Review plugin for WordPress, in versions prior to 2.4.4, fails to adequately sanitize and escape input from its public review submission form. This vulnerability enables unauthenticated attackers to submit malicious scripts as part of reviews, which are then stored and rendered on pages displaying those reviews. When other users, including administrators, view these pages, the malicious scripts execute, constituting a stored Cross-Site Scripting (CWE-79) attack.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the affected site for any user viewing the malicious review, potentially resulting in session hijacking, privilege escalation, or other malicious actions depending on the victim's privileges. Since the review form is public and unauthenticated, any attacker can submit payloads without authentication. The impact includes risk to all users who access pages displaying user reviews, including administrators.

Users should upgrade the WP Ultimate Review plugin to version 2.4.4 or later, where this vulnerability is fixed. No other mitigation guidance is provided, and patch status is confirmed by the version boundary. Until updated, disabling user reviews or restricting access to the review submission form may reduce risk.