CVE-2023-47653 MEDIUM

CVE-2023-47653: WordPress TWB Woocommerce Reviews Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Vendor Abu Bakar
Product TWB Woocommerce Reviews
Weakness CWE-79 · XSS
Published November 14, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abu Bakar TWB Woocommerce Reviews plugin <= 1.7.5 versions.

Explanation of Vulnerability in Simple Terms

02Summary

TWB Woocommerce Reviews versions up to 1.7.5 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts into review content. When other users view the affected reviews, the scripts execute in their browsers, potentially compromising their sessions or stealing data. The vulnerability requires user interaction—victims must view the page containing the injected script.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts into reviews that execute when other users view them, potentially stealing session data or redirecting users.

Potential impact on your site

04Site Impact

Administrators can inject scripts affecting all site visitors; stored XSS can compromise user sessions and data across your entire site.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrator privileges and the victim must view the page containing the injected script.

Key dates

06Disclosure timeline

November 14, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8489 Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-27426 WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-57351 WordPress HandL UTM Grabber plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57359 WordPress ReviewX plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability