EUVD-2026-83575
GHSA-xp7f-phvw-3c2v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with payload in wpcr3_fname
-
DeliveryDeliver link to victim via phishing
-
ExploitVictim clicks and loads review form
-
ExecutionReflected script executes in browser
-
ImpactHijack session or perform actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim to click an attacker-crafted link containing a malicious payload in the 'wpcr3_fname' parameter against a site running WP Customer Reviews <=3.7.8; no authentication is needed (PR:N), but successful exploitation depends entirely on user interaction (UI:R) and the target page reflecting the parameter into the review form. The reflected (non-persistent) nature limits it to per-victim social engineering rather than broad automated compromise, and script execution is confined to the victim's browser session. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) describes a classic reflected XSS: network-reachable, low-complexity, unauthenticated, but gated behind required user interaction (a victim must click a crafted link), with a scope change reflecting script execution in the victim's browser context and limited confidentiality/integrity impact. No EPSS score, CISA KEV entry, or public POC is present in the provided data, so there is no evidence of active exploitation or automatable mass-scanning - this reads as a real-but-moderate issue rather than an urgent priority. Reflected XSS in WordPress plugins is common and generally requires social engineering per-victim, which caps real-world impact; the PR:N rating is technically accurate (no login needed) but the UI:R requirement is the dominant limiting factor. No conflicting signals were found: the network vector matches the reflected-parameter delivery model described. |
| Exploit ScenarioDerived | An attacker crafts a URL to a WordPress site running WP Customer Reviews with a malicious script payload in the 'wpcr3_fname' parameter and lures a victim (via phishing email or link) into clicking it. When the victim's browser loads the review form page, the unsanitized parameter is reflected into the page and the injected JavaScript executes in the victim's session, enabling cookie/session theft or actions in the site context. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Reflected cross-site scripting in the WP Customer Reviews plugin for WordPress (vendor: bompus) affects every release up to and including 3.7.8, allowing an unauthenticated attacker to inject arbitrary script into the review form through the 'wpcr3_fname' parameter. Exploitation is not automatic: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium) requires the victim to click an attacker-supplied link, and the injected code then runs only in that victim's browser session with limited confidentiality and integrity impact. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; EPSS data was not provided, so real-world exploitation likelihood should be treated as low-to-moderate, driven by social engineering rather than mass scanning. Wordfence reported the issue and upstream code changes are visible in the plugin's Trac repository.
RemediationAI
An upstream fix is present in the plugin repository changelog changeset 3571227 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3571227%40wp-customer-reviews&new=3571227%40wp-customer-reviews), which is a commit-level fix rather than an independently verified tagged release, so administrators should upgrade to the first plugin version published after 3.7.8 and confirm the changelog entry before assuming remediation is complete - the precise patched version number is not confirmed by the available data, so do not treat 3.7.8 as safe. If an upgrade cannot be applied immediately, compensating controls include deactivating the plugin outright (eliminates the finding but removes customer review functionality and any stored reviews from display) or, where the plugin must remain active, deploying a WAF/virtual-patching rule that blocks or encodes request parameters containing script-like content in 'wpcr3_fname' (Wordfence and most managed WAFs can target this), accepting that obfuscated payloads may bypass signature-based rules. Site operators can also apply the code-level fix directly by wrapping the 'wpcr3_fname' output in esc_attr() / esc_html() in include/templates/frontend_review_form_text_field.html and sanitizing the parameter in wp-customer-reviews-3.php, but manual edits will be overwritten by the next plugin update and should be treated as temporary. Because exploitation depends on a victim clicking an attacker-crafted link, user awareness training and phishing resistance reduce exposure but are not a substitute for patching; monitor web logs for requests with unusual 'wpcr3_fname' values as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: user-controlled data from the request is echoed back into the generated HTML without adequate sanitization or escaping. The affected plugin, WP Customer Reviews, renders a public-facing review submission form whose text fields are templated in files such as include/templates/frontend_review_form_text_field.html, where the 'wpcr3_fname' (first name) input is populated. The referenced source lines in wp-customer-reviews-3.php (approximately lines 257, 272, and 1051) and the template line 13 show where the parameter is read and emitted; the parameter is not passed through WordPress escaping functions such as esc_attr()/esc_html() or sanitize_text_field() before output, so a crafted query string is reflected verbatim into the page and parsed by the browser as markup or script. Because the payload is reflected and not stored, it does not persist on the server; the CPE string cpe:2.3:a:bompus:wp_customer_reviews marks the entire unversioned version range as affected, consistent with the advisory covering all versions up to and including 3.7.8. The scope-change component (S:C) reflects that script executes in the victim's authenticated WordPress browsing context, potentially allowing session abuse or page manipulation, though read/write impact remains limited (C:L/I:L).
Know when Wp Customer Reviews gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network-reachable reflected XSS (PR:N) but needs victim click (UI:R); browser-context script execution crosses scope (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wp Customer Reviews
View allUnvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead t
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege use
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and incl
Exploit-DB