WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

PoC

Note: First, you need to connect a Google My Business, select Account, and select Location. Exploit shortcode: [gmb-review location=‘accounts/116528705904907295451/locations/18424478508029415538’ autoplay=“’ onmouseover=‘alert(1)’ style=‘background:red;width:100px;height:100px;’”]