Customer Reviews for WooCommerce EUVD-2026-39704

Exploitation requires the Customer Reviews for WooCommerce plugin (≤ 5.110.1) to be installed and active on a WordPress/WooCommerce site, and - per the CVSS vector - requires victim interaction (UI:R): a user must load the page that renders the attacker-injected content for the script to fire. No authentication is required to inject the payload (PR:N), and attack complexity is low (AC:L), so the attacker side needs no special privileges or configuration. What limits exploitation is the dependency on victim interaction and the fact that impact is rated Low across C/I/A, meaning consequences are bounded by what script in the victim's browser context can achieve rather than direct server compromise. The description does not specify whether the XSS is stored or reflected or name the exact vulnerable parameter/feature, so the precise injection vector should be confirmed against the vendor advisory.

Signals are moderate and partly incomplete. The CVSS 3.1 base score of 7.1 reflects network attack vector, low complexity, and no privileges required, but it is tempered by the User Interaction requirement (UI:R) - a victim must visit or render the malicious content - and only Low impact across confidentiality, integrity, and availability. The Changed scope inflates the score relative to the limited per-impact ratings. No KEV listing and no POC were indicated, and no EPSS probability was provided, so there is no evidence of widespread or active exploitation; this looks like a real but routine plugin XSS rather than an urgent mass-exploitation event. A notable gap: the description labels this 'Unauthenticated XSS' and the vector confirms PR:N, but it does not state whether the payload is stored or reflected, which materially changes how easily a victim can be lured - verify the injection point with the Patchstack advisory.

An attacker submits a product review (or sends a crafted request to a review-handling endpoint) containing a malicious script payload that the plugin stores or reflects without proper encoding. When a shopper or store administrator subsequently views the product page or review listing, the script executes in their browser session, enabling session/cookie theft, content defacement, or redirection. No public exploit code is identified at this time, and successful exploitation depends on a victim viewing the malicious content (UI:R).