Cross-Site Scripting Vulnerability in WooCommerce Photo Reviews by VillaTheme

CVE-2025-47570

What is CVE-2025-47570?

A Cross-Site Scripting (XSS) vulnerability exists in the WooCommerce Photo Reviews plugin by VillaTheme, which allows attackers to inject malicious scripts into web pages. This issue affects all versions of the plugin up to 1.3.13, posing a significant risk to users as it can result in unauthorized actions or data theft when exploited. Proper input sanitization and validation are crucial to mitigate this vulnerability and protect user data.

References