Executive brief
The Customer Reviews for WooCommerce plugin adds review functionality to online product pages. Attackers who obtain a review form URL (sent via customer emails) can inject malicious scripts into product reviews that will execute for all site visitors, potentially stealing customer data, session cookies, or redirecting users to phishing sites.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the plugin's review submission handling. The 'cr_local_forms_submit' AJAX action accepts unauthenticated review submissions, fails to sanitize HTML content in the review comment text before passing it to wp_insert_comment(), and then renders stored comments via comment_text() without proper output escaping. An attacker who obtains a valid review form URL (e.g., from customer reminder emails) can submit malicious JavaScript payloads that persist in the WordPress comment database and execute in the browsers of all subsequent visitors to the affected product page. The vulnerability affects versions up to 5.106.0; patch availability should be verified with the plugin maintainers.
Affected products
- Automattic Customer Reviews for WooCommerce up to and including 5.106.0
Timeline
- 2026-08-28: disclosed