This vulnerability in richplugins' Rich Showcase for Google Reviews widget-google-reviews allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 6.9.4.3. The vulnerability enables an attacker with high privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, scoring 5.9 (medium severity). No patch or vendor advisory information is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to inject stored malicious scripts that execute when other users view the affected content, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium with low confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to the plugin and limit user interaction with untrusted input. Monitor vendor channels for updates and apply patches promptly once released.