What is the CVSS score of CVE-2026-3355?

CVE-2026-3355 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3355

EUVD-2026-23207 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 07:50 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 07:30 euvd

EUVD-2026-23207

Analysis Generated

Apr 16, 2026 - 07:30 vuln.today

CVE Published

Apr 16, 2026 - 06:44 nvd

MEDIUM 6.1

DescriptionCVE.org

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘crsearch’ parameter in all versions up to, and including, 5.101.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arbitrary JavaScript via the unescaped 'crsearch' parameter, affecting all versions up to 5.101.0. Exploitation requires social engineering (victim must click a malicious link), but successful attacks can steal session cookies, perform actions as the logged-in user, or redirect to phishing sites. No public exploit code or active exploitation has been identified, though the vulnerability is trivially reproducible given the simple parameter manipulation required.

Technical ContextAI

The vulnerability exists in the Customer Reviews for WooCommerce plugin (CPE: ivole:customer_reviews_for_woocommerce), a WordPress plugin that displays customer product reviews. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), stemming from insufficient input sanitization and output escaping on the 'crsearch' parameter. This parameter is likely used for filtering or searching reviews, but user input is reflected directly into the HTML response without proper escaping (e.g., missing wp_kses_post(), esc_attr(), or esc_html() WordPress functions). Reflected XSS occurs when untrusted data enters a web application and is immediately returned to the user's browser without validation or encoding, allowing injected scripts to execute in the victim's security context.

RemediationAI

Update the Customer Reviews for WooCommerce plugin to version 5.101.1 or later immediately via WordPress plugin admin panel (Plugins → Updates → Update Now) or manually via WordPress.org plugin repository. For sites unable to update immediately, disable the Customer Reviews for WooCommerce plugin until patching is completed (Plugins → Deactivate), though this removes review functionality. As a temporary compensating control, web application firewall rules can block requests containing script tags in the 'crsearch' parameter (e.g., block URLs matching crsearch=.*<script), but this may cause false positives and does not address the root cause. Network-level mitigation is impractical for reflected XSS. Educate WordPress administrators and site users not to click links from untrusted sources pointing to your WordPress site with unusual URL parameters. After patching, review WordPress plugin and theme update policies to ensure faster patching cycles for future vulnerabilities.