rootpwn

high · CVSS v3 7.2 · EPSS 0.00241

CVE-2026-97663

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to stored XSS via the comment author name field. Unauthenticated att

Overview

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to stored XSS via the comment author name field. Unauthenticated attackers can inject scripts that execute when users view reviews, provided the image attachment feature is enabled. This allows malicious code to run in the context of site visitors.

Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.

Impact

Confidentiality: injected scripts can steal user data or session cookies. Integrity: review content can be altered or malicious content displayed. Availability: not directly affected. Defenders: site owners, administrators, and users of WordPress sites using the plugin.

Remediation

Update the plugin to version 5.122.1 or later. Disable the image attachment feature if not required. Ensure input sanitization and output escaping for review fields. Implement site-wide XSS mitigations such as a strong Content Security Policy.

Risk context

High severity (CVSS 7.2) and low EPSS (0.00241) indicate moderate likelihood but high impact; patching should be prioritized promptly.

Affected products

  • WordPress
  • WooCommerce
  • Customer Reviews for WooCommerce plugin

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
0.00241

XSS WordPress WooCommerce StoredXSS CustomerReviews HighSeverity EPSS

← All CVEs

Related CVEs

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis

high

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Malicious script payloads placed in the title attribute of an anchor tag survive WordPress's comment kses filter at save time, as the payload is only promoted to executable HTML attributes when the plugin's page-wide regex strips the closing quote delimiter at render time; exploitability is therefore subject to the standard comment moderation workflow before the comment is publicly displayed.

View analysis

high

CVE-2026-101160

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.

View analysis