A reflected cross-site scripting vulnerability in the jegtheme Epic Review plugin allows unauthenticated attackers to execute arbitrary scripts in a user's browser session.

This is a reflected XSS vulnerability (CWE-79) residing in the Epic Review plugin. The flaw allows an unauthenticated attacker to inject malicious scripts into the web page, which are then executed when a victim visits the crafted URL.

Successful exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of the user, or the redirection of visitors to malicious websites. With a CVSS score of 7.1, this flaw is categorized as High severity because it facilitates potential account compromise and data exfiltration, which can significantly damage organizational reputation and user trust.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and uninstall the Epic Review plugin until the vendor releases a secure update.

Proactive Monitoring: Monitor web server access logs for anomalous URL parameters containing script tags or encoded characters that indicate probing for XSS vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to inspect incoming traffic and block requests containing suspicious script payloads before they reach the application.

Public Exploit Available: No.

The high CVSS score reflects the significant risk posed by this vulnerability to any site utilizing the Epic Review plugin. Given the lack of a confirmed patch, the most effective security posture is to remove the vulnerable code entirely from the environment. Security teams should prioritize the identification and removal of this plugin across all WordPress instances to prevent potential exploitation.