Customer Reviews For Woocommerce
Monthly
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.0) allows any authenticated WordPress user - including low-privilege Subscribers - to invoke administrative settings functions, overwrite plugin configuration options, and read sensitive store configuration data. The flaw stems from absent nonce verification and WordPress capability checks on AJAX actions that should be restricted to shop administrators. A public exploit exists via WPScan, though EPSS signals low widespread opportunistic exploitation at 0.14% (4th percentile); no CISA KEV listing indicates mass exploitation has not been observed.
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0) allows any remote user to push image and video files directly into the WordPress Media Library, leading to media library pollution and disk space exhaustion. The flaw is conditionally exploitable - the plugin's review media attachment feature must be enabled - but when active, requires no credentials, nonce, or capability check on the affected AJAX action. No active exploitation is confirmed in CISA KEV, though a publicly available proof-of-concept has been published by WPScan, and the SSVC framework flags the attack as automatable.
Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows contributor-level authenticated users to inject arbitrary JavaScript via the 'color' attribute of the trust badge shortcode, which then executes in the browsers of every subsequent visitor to the compromised page. The trust badge rendering code in class-cr-trust-badge.php and badge-small.php fails to sanitize or escape shortcode attribute input before writing it to HTML output. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a patch commit is referenced in the WordPress SVN repository.
Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arbitrary JavaScript via the unescaped 'crsearch' parameter, affecting all versions up to 5.101.0. Exploitation requires social engineering (victim must click a malicious link), but successful attacks can steal session cookies, perform actions as the logged-in user, or redirect to phishing sites. No public exploit code or active exploitation has been identified, though the vulnerability is trivially reproducible given the simple parameter manipulation required.
Unauthenticated attackers can bypass authentication in Customer Reviews for WooCommerce plugin versions up to 5.103.0 by submitting an empty string as the review permission key, allowing them to create, modify, and inject malicious product reviews via the REST API without any legitimate order association. The vulnerability exploits improper key validation using strict equality comparison without checking for empty values, combined with auto-approval of reviews by default, enabling widespread review injection across all products on affected WooCommerce installations.
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.36.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.47.0 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.38.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in Customer Reviews for WooCommerce (all versions before 5.118.0) lets unauthenticated attackers inject persistent malicious scripts by submitting crafted review content through a vulnerable plugin endpoint, with the payload stored in the WordPress database. When an authenticated user - particularly a store administrator - views the affected review, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available exploit exists per WPScan; EPSS sits at 0.17% (7th percentile), indicating limited observed mass exploitation despite POC availability, and the vulnerability is not currently in CISA KEV.
Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.
Missing authorization on multiple AJAX settings handlers in Customer Reviews for WooCommerce (all versions before 5.116.0) allows any authenticated WordPress user - including low-privilege Subscribers - to invoke administrative settings functions, overwrite plugin configuration options, and read sensitive store configuration data. The flaw stems from absent nonce verification and WordPress capability checks on AJAX actions that should be restricted to shop administrators. A public exploit exists via WPScan, though EPSS signals low widespread opportunistic exploitation at 0.14% (4th percentile); no CISA KEV listing indicates mass exploitation has not been observed.
Unauthenticated media file upload in the Customer Reviews for WooCommerce WordPress plugin (all versions before 5.113.0) allows any remote user to push image and video files directly into the WordPress Media Library, leading to media library pollution and disk space exhaustion. The flaw is conditionally exploitable - the plugin's review media attachment feature must be enabled - but when active, requires no credentials, nonce, or capability check on the affected AJAX action. No active exploitation is confirmed in CISA KEV, though a publicly available proof-of-concept has been published by WPScan, and the SSVC framework flags the attack as automatable.
Stored Cross-Site Scripting in the Customer Reviews for WooCommerce WordPress plugin (all versions ≤ 5.113.0) allows contributor-level authenticated users to inject arbitrary JavaScript via the 'color' attribute of the trust badge shortcode, which then executes in the browsers of every subsequent visitor to the compromised page. The trust badge rendering code in class-cr-trust-badge.php and badge-small.php fails to sanitize or escape shortcode attribute input before writing it to HTML output. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a patch commit is referenced in the WordPress SVN repository.
Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arbitrary JavaScript via the unescaped 'crsearch' parameter, affecting all versions up to 5.101.0. Exploitation requires social engineering (victim must click a malicious link), but successful attacks can steal session cookies, perform actions as the logged-in user, or redirect to phishing sites. No public exploit code or active exploitation has been identified, though the vulnerability is trivially reproducible given the simple parameter manipulation required.
Unauthenticated attackers can bypass authentication in Customer Reviews for WooCommerce plugin versions up to 5.103.0 by submitting an empty string as the review permission key, allowing them to create, modify, and inject malicious product reviews via the REST API without any legitimate order association. The vulnerability exploits improper key validation using strict equality comparison without checking for empty values, combined with auto-approval of reviews by default, enabling widespread review injection across all products on affected WooCommerce installations.
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.36.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.47.0 due to insufficient input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommerce_json_search_coupons' function . Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the send_test_email() function in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce.38.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ivole_import_upload_csv AJAX action in all versions up to,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.