Five Star Restaurant Reviews EUVD-2026-90517

Exploitation requires an attacker to deliver a crafted request (malicious link or auto-submitting form) to a victim who must then submit/open it - UI:R user interaction is mandatory, so this is not autonomously wormable. Maximum impact is realized when the tricked victim is a logged-in WordPress administrator, enabling actions in an authenticated admin context. The target site must run the Five Star Restaurant Reviews plugin at a version before 2.3.14 with the vulnerable value-output path reachable; no authentication is needed by the attacker (PR:N), but successful payload execution depends entirely on social-engineering the victim into triggering the request.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) describes a classic reflected cross-site scripting flaw: network-reachable, low complexity, no privileges, but requiring user interaction (UI:R), with a scope change because script executes in a victim's browser rather than the plugin's own security context. This is a genuine but conditional risk - the 7.1 is elevated largely by the scope-change (S:C) and the chained C:L/I:L/A:L impacts, not by trivial server-side compromise. No EPSS score, no CISA KEV entry, and no public exploit code are present in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The practical priority is moderate: reflected XSS demands that an attacker lure a victim (ideally a logged-in administrator) into submitting a crafted request, which limits mass/automated exploitation. I would note one discrepancy: the vendor assigns A:L (availability) which is unusual for reflected XSS - such flaws typically have no genuine availability impact; my independent assessment drops A to N. Overall this is a real, patch-worthy web vulnerability but not a drop-everything emergency absent evidence of active exploitation.

An attacker crafts a malicious URL or form submission targeting the Five Star Restaurant Reviews plugin endpoint, embedding script into a user-supplied value that the plugin outputs into an HTML tag without proper escaping. The attacker phishes or socially engineers a logged-in WordPress administrator into submitting the crafted request, causing arbitrary JavaScript to run in the admin's authenticated browser session (e.g., to create a rogue admin, steal nonces/cookies, or alter content). No public proof-of-concept is identified at time of analysis.