EUVD-2026-91237
GHSA-x5w6-fhq8-hh7v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network submission (PR:N/AV:N), stored XSS crossing into the admin/victim browser context gives S:C with C:L/I:L and no availability impact; feature dependency noted separately rather than raising AC.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.
AnalysisAI
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and including 5.122.0, allows unauthenticated remote attackers to inject malicious scripts via the Comment Author Name when the image attachment feature (ivole_attach_image) is enabled. The vulnerability arises from insufficient input sanitization and output escaping, and the payload executes when a victim (such as an administrator viewing the reviews list table or a site visitor) loads the affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the plugin's image attachment feature (ivole_attach_image) to be ENABLED; this exposes the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend AJAX endpoint that lets an unauthenticated attacker complete a review submission carrying an entity-encoded malicious Comment Author Name. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional priority rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched version is provided in the available data; however, the vendor has published a changeset (3716157, https://plugins.trac.wordpress.org/changeset/3716157/) that appears to address the vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running Customer Reviews for WooCommerce at version 5.122.0 or below and immediately disable the optional image attachment feature (the ivole_attach_image setting); if that feature is business-critical, temporarily deactivate the plugin instead, and in parallel scan existing review records for script tags or unexpected markup in the comment author name field and purge anything found. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attac
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, wh
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0)
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logo
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at W
Remote unauthenticated attackers can delete arbitrary content, including customer reviews, on WordPress/WooCommerce site
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at Wo
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106
Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows con
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today