EUVD-2026-39704
GHSA-c8g2-rm3w-x2p5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable unauthenticated injection (AV:N/PR:N/AC:L) requiring a victim to view the content (UI:R); browser-context script execution crosses scope (S:C) with limited C/I/A impact.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.
Articles & Coverage 1
AnalysisAI
Stored/reflected Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.110.1) lets unauthenticated attackers inject malicious script that executes in a victim's browser when they view the affected page. The CVSS:3.1 vector (AV:N/PR:N/UI:R, scope changed) indicates network-reachable, no-authentication exploitation that requires the victim to interact with attacker-controlled content. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
Customer Reviews for WooCommerce is a popular WooCommerce add-on plugin that collects, moderates, and displays product reviews on WordPress storefronts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input - plausibly review content, reviewer fields, or related request parameters - is rendered back into a page without sufficient output encoding or input sanitization. Because the CVSS scope is Changed (S:C), the injected script executes in a security context different from the vulnerable component, which is typical of XSS where attacker code runs in the browser/session of the viewing user rather than the plugin's own context. No CPE strings were supplied; affected-product identity is derived from the EUVD entry for the plugin.
RemediationAI
Update the Customer Reviews for WooCommerce plugin to the first release above 5.110.1 once the vendor publishes it; no exact fixed version was included in the provided data, so confirm the patched release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/customer-reviews-woocommerce/vulnerability/wordpress-customer-reviews-for-woocommerce-plugin-5-110-1-cross-site-scripting-xss-vulnerability) before deploying. If a patched version is not yet available, compensating controls include placing a Web Application Firewall (such as Patchstack's or another WordPress-aware WAF) in front of the site with XSS rules covering the review-submission and review-display paths, which may produce false positives on legitimate reviews containing markup; enabling manual moderation/approval of all reviews before they render so injected payloads are caught before reaching shoppers, at the cost of slower review publishing; and adding a restrictive Content-Security-Policy to limit inline-script execution, which can break legitimate inline scripts and themes if not tuned. Disabling the plugin entirely removes the risk but also removes review functionality.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today