Photo Reviews For Woocommerce
Monthly
Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.
Reflected cross-site scripting (XSS) in the VillaTheme 'Photo Reviews for WooCommerce' plugin for WordPress affects all versions through 1.2.30, allowing an unauthenticated attacker to inject script into a page viewed by a victim. Exploitation is phishing-driven: the attacker must lure a targeted visitor to a crafted URL, and the payload executes only in that victim's browser session, giving CVSS 3.1 a base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) rather than server-wide compromise. No public exploit code identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the vulnerability was reported by Patchstack and the exact vulnerable parameter or endpoint is not detailed in the available data.
Unauthenticated attackers can permanently delete arbitrary posts, pages, products, and media attachments on any WordPress site running the Photo Reviews for WooCommerce plugin through version 1.2.30. The plugin accepts attacker-controlled post IDs in the public wcpr_image_upload_id parameter of a review submission and stores them as the review's 'reviews-images' comment meta without verifying that those IDs belong to attachments owned by the submitter; when the review is later deleted, the delete_reviews_image() handler unconditionally calls wp_delete_post( $id, true ) on every stored ID. Because the trigger is a privileged action - an administrator deleting the planted review, or WordPress's built-in wp_scheduled_delete cron emptying the comment trash roughly 30 days after the review is trashed - this is a credible high-integrity, high-availability issue rather than an instantly weaponizable one, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated Insecure Direct Object Reference (IDOR) in the Photo Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.2.30, allows remote attackers with no credentials and no user interaction to reference objects they should not be authorized to reach, degrading availability of the affected site's review functionality (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation requires only that the plugin be installed and active on a network-reachable WordPress/WooCommerce installation; no special feature toggle or non-default configuration is named in the advisory. There is no public exploit code identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), so exposure is currently driven by the low attack complexity and the unauthenticated, remote nature of the flaw rather than by observed in-the-wild activity.