What is the CVSS score of CVE-2026-13771?

CVE-2026-13771 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Customer Reviews WooCommerce CVE-2026-13771

EUVD-2026-42526 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-q7qc-p277-8cmp

WordPress XSS Customer Reviews For Woocommerce

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Contributor authentication is required (PR:L); a victim must visit the injected page (UI:R); impact crosses into victim browser sessions via scope change (S:C); no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:48 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

MEDIUM 6.4

DescriptionCVE.org

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows contributor-level authenticated users to inject arbitrary JavaScript via the 'color' attribute of the trust badge shortcode, which then executes in the browsers of every subsequent visitor to the compromised page. The trust badge rendering code in class-cr-trust-badge.php and badge-small.php fails to sanitize or escape shortcode attribute input before writing it to HTML output. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a patch commit is referenced in the WordPress SVN repository.

Technical ContextAI

The vulnerability is rooted in the trust badge shortcode subsystem of the Customer Reviews for WooCommerce plugin (CPE: cpe:2.3:a:ivole:customer_reviews_for_woocommerce:*:*:*:*:*:*:*:*). The affected code paths are concentrated in includes/trust-badge/class-cr-trust-badge.php (lines 30, 60, and 334) and templates/badge-small.php, where the 'color' attribute supplied to the trust badge shortcode is interpolated into HTML without applying WordPress output-escaping functions such as esc_attr() or wp_kses(). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies this as a failure at the output layer: user-controlled shortcode attribute values are written raw into the DOM, permitting an attacker to embed executable script tags or event handlers. Because the injected payload is stored in WordPress post or page content, it persists and executes in the browser of every user - including administrators - who subsequently loads the affected page, satisfying the classic stored-XSS threat model.

RemediationAI

Update the Customer Reviews for WooCommerce plugin to the version incorporating SVN changeset 3597201, referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3597201%40customer-reviews-woocommerce&new=3597201%40customer-reviews-woocommerce - the exact released version number containing this fix is not independently confirmed from available input data, so administrators should update to the latest available version via the WordPress admin dashboard (Plugins > Installed Plugins > Update) or via WP-CLI ('wp plugin update customer-reviews-woocommerce'). As a compensating control prior to patching, restrict contributor-level and author-level WordPress roles to only fully trusted individuals, since exploitation requires at minimum contributor access. If the trust badge shortcode feature is not actively used, disabling or restricting shortcode execution for lower-privileged roles via a shortcode-filtering plugin is an additional mitigation, though this may affect plugin functionality. Administrators should also audit existing published pages and posts for unexpected script content within trust badge shortcode 'color' attributes.