This vulnerability in the WooCommerce Photo Reviews plugin by villatheme allows an attacker to inject malicious scripts due to improper sanitization of HTML tags in web pages generated by the plugin. The issue affects all versions up to and including 1.4.4. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to confidentiality loss, with no integrity or availability impact reported. No vendor advisory or patch links are currently available, and the plugin is not a cloud service.

The vulnerability enables an attacker to perform basic cross-site scripting attacks, potentially leading to limited confidentiality breaches such as theft of user session data or information accessible via injected scripts. There is no reported impact on integrity or availability. Exploitation does not require privileges or user interaction, increasing the risk of remote exploitation. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the use of the WooCommerce Photo Reviews plugin if feasible. Monitor official villatheme channels for updates and apply patches promptly once available.