Executive brief
Customer Reviews for WooCommerce is a popular WordPress plugin for collecting and displaying product reviews on WooCommerce stores. An attacker can inject malicious JavaScript code into customer reviews via an unauthenticated API endpoint, which will execute in the browsers of all site visitors (including administrators) when the product page is viewed. This could lead to theft of admin credentials, installation of malware, or unauthorized changes to the store.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the plugin's review submission endpoint (/wp-json/ivole/v1/review). The endpoint fails to sanitize and escape the "comment" parameter when processing the initial review submission for a product. An unauthenticated attacker with a valid per-order key (issued during review invitation emails) can POST a malicious JavaScript payload that is stored in the database without sanitization. When the product page is rendered, the raw HTML comment is displayed to all visitors, causing the script to execute in their browsers. The flaw affects versions before 5.118.0 and has been patched in 5.118.0.
Affected products
- Ivole Customer Reviews for WooCommerce before 5.118.0
Timeline
- 2026-08-28: disclosed
- 2026-08-30: patched: Fixed in version 5.118.0