Reflected Cross-Site Scripting Vulnerability in WP Customer Reviews Plugin by WordPress

CVE-2025-14452

What is CVE-2025-14452?

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting through the 'wpcr3_fname' parameter due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages. If a user is deceived into clicking a crafted link, the scripts execute in their browser context, potentially leading to session hijacking or unauthorized actions performed on behalf of the user.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References