This vulnerability in WooCommerce Photo Reviews (versions up to 1.4.4) arises from improper neutralization of script-related HTML tags in web pages, enabling basic cross-site scripting (XSS) attacks. The issue allows an attacker to inject code remotely without requiring privileges or user interaction. The CVSS score is 5.3 (medium), reflecting a network attack vector with low complexity and no privileges or user interaction needed. The vulnerability impacts data integrity but not confidentiality or availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker can inject malicious scripts into web pages served by the vulnerable WooCommerce Photo Reviews plugin, potentially leading to code execution in the context of users viewing the affected pages. This compromises data integrity but does not affect confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as input validation or output encoding if feasible. Monitor vendor channels for updates and apply patches promptly once available.