Photo Reviews EUVD-2026-96216

Requires the VillaTheme 'Photo Reviews for WooCommerce' plugin installed and active at version 1.2.30 or earlier on a WooCommerce store, with the product review form (which prints the wcpr_image_upload nonce) exposed on the frontend - this is default behavior, so no special configuration is needed to inject. No authentication, capability, or attachment-ownership check applies, so any unauthenticated visitor who reads the public nonce can store a payload. The primary limiting factor is that this is STORED XSS: the script only fires when a victim (shopper or admin) subsequently loads the product page displaying the injected review, so impact depends on that page being viewed rather than executing at injection time.

This is a genuine, actionable priority for sites running the affected plugin, though not a top-tier internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) indicates a network-reachable, low-complexity attack requiring no privileges, consistent with the description: the only gate is the publicly-emitted wcpr_image_upload nonce printed on every product review form, so exploitation is effectively unauthenticated. The scope change (S:C) correctly reflects that the stored payload executes in the browser of any visitor who later views the review, impacting a component beyond the vulnerable server. On the mitigating side, no EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this signal is MISSING rather than negative. The impact is also bounded (C:L/I:L/A:N): stored XSS in a review context typically enables session/cookie theft, admin-session riding, or defacement rather than direct server compromise. Note one nuance to verify: the CVSS uses UI:N, but as stored XSS the payload only fires when a victim loads the injected page - the injection step itself needs no interaction, so UI:N is defensible under Wordfence convention, but defenders should understand a victim page-view is still required for impact. Overall: a real priority to patch on affected WooCommerce stores, but currently 'high-CVSS without confirmed real-world exploitation.'

An unauthenticated attacker scrapes the publicly-printed wcpr_image_upload nonce from any product review form, then submits a crafted wcpr_image_upload_id value containing a malicious script. Because the value is stored in comment meta (which is not filtered by wp_kses) with no capability, authentication, or attachment-ownership check, the payload persists and executes in the browser of any shopper or administrator who subsequently views that product's reviews. No public exploit code was identified in the provided data.