Stored Cross-Site Scripting in Social Reviews & Recommendations Plugin for WordPress

CVE-2025-12705

What is CVE-2025-12705?

The Social Reviews & Recommendations plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to poor input sanitization and output escaping in the 'trim_text' function. This vulnerability affects all versions up to and including version 2.5, allowing unauthenticated attackers to insert arbitrary web scripts into pages. When users access these compromised pages, the injected scripts execute, potentially leading to significant security risks. A partial patch was introduced in version 2.5, but it is crucial for users to ensure they are using the latest version to mitigate this risk.

References