What the vulnerability does
01Description
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it via wp_insert_comment(), and later renders this stored content on product pages through comment_text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.
Explanation of Vulnerability in Simple Terms
02Summary
Customer Reviews for WooCommerce versions up to 5.106.0 contain a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts. The vulnerability affects the scope beyond the vulnerable component, potentially impacting other parts of the site. No user interaction is required for exploitation. Site administrators should update to a version newer than 5.106.0.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in the site, affecting other users and site functionality.
Potential impact on your site
04Site Impact
Attackers can steal customer data, deface your site, or redirect visitors to malicious pages without any user clicking a link.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 28, 2026
CVE published
