This vulnerability in the WP Google Review Slider plugin (versions <=18.0) allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks due to improper neutralization of input during web page generation. The CVSS 3.1 base score is 6.3, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The impact includes limited confidentiality, integrity, and availability consequences. No known exploits are currently reported in the wild, and no official fix or vendor advisory has been published yet.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to limited information disclosure, modification of web content, or disruption of availability. However, the impact is limited by the requirement for user interaction and the lack of privileges needed by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying temporary mitigations such as input validation or output encoding if feasible. Monitor official vendor channels for updates and patches.