Ilkeggs

**Name of the Vulnerable Software and Affected Versions** Reviews Widgets for Google, Yelp & TripAdvisor versions prior to 2.7.4 **Description** Stored Cross-Site Scripting occurs when authenticated attackers with contributor-level access or higher inject arbitrary web scripts into pages. The issue stems from insufficient input sanitization and output escaping in the `Feed Shortcode::fbrev()` method. Specifically, the `page id` attribute of the `[fbrev]` shortcode is passed through `Feed Old::get feed()` to the `View::render()` method, where it is echoed directly into the `data-id` HTML attribute without using `esc attr()`. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update Reviews Widgets for Google, Yelp & TripAdvisor to version 2.7.4 or later. As a temporary mitigation, restrict the use of the `page id` attribute within the `[fbrev]` shortcode for users with contributor-level access.