Quick answers
- Is CVE-2026-76585 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76585 being exploited in the wild.
- How severe is CVE-2026-76585?
- High severity, with a CVSS score of 8.8, published 30 August 2026.
- Which products and versions are affected?
- Ivole Customer Reviews for WooCommerce before 5.118.0.
- Is there a fix for CVE-2026-76585?
- A patch was published on 2026-08-30: Fixed in version 5.118.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-76585 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-76585?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the plugin's review submission endpoint (/wp-json/ivole/v1/review). The endpoint fails to sanitize and escape the "comment" parameter when processing the initial review submission for a product. An unauthenticated attacker with a valid per-order key (issued during review invitation emails) can POST a malicious JavaScript payload that is stored in the database without sanitization. When the product page is rendered, the raw HTML comment is displayed to all visitors, causing the script to execute in their browsers. The flaw affects versions before 5.118.0 and has been patched in 5.118.0.
Affected products
- Ivole Customer Reviews for WooCommerce before 5.118.0
Timeline
- 2026-08-28: disclosed
- 2026-08-30: patched: Fixed in version 5.118.0