Junglewise Threat Intelligence

CVE-2026-13771: WooCommerce Customer Reviews Stored XSS in color shortcode attribute

CVE-2026-13771 · Severity: medium · CVSS 6.4 · Published 2026-07-09

Technologies: Ivole Customer Reviews for WooCommerce. Vendors: CusRev.

Executive brief

The Customer Reviews for WooCommerce plugin for WordPress, which helps online stores manage and display customer feedback, contains a security flaw. An attacker with basic contributor-level access can inject malicious scripts into website pages. When other users or administrators visit these pages, the scripts execute, potentially leading to unauthorized actions or data theft.

Technical details

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'color' attribute within its shortcode functionality. The vulnerability exists in versions up to and including 5.113.0. An authenticated attacker with contributor-level permissions or higher can exploit this by embedding malicious JavaScript into a page via the shortcode. Because the input is stored and later rendered without proper neutralization, the script executes in the context of any user's browser who views the page. This can lead to session hijacking or unauthorized administrative actions if a site administrator views the compromised content.

Affected products

  • ivole Customer Reviews for WooCommerce <= 5.113.0

Timeline

  • 2026-07-09: disclosed: CVE published to NVD dataset

References

Related threats