Stored Cross-Site Scripting Vulnerability in Customer Reviews for WooCommerce Plugin by WordPress
CVE-2026-13771

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Customer Reviews For WooCommerce
Vendor
CVE Published:
9 July 2026

What is CVE-2026-13771?

The Customer Reviews for WooCommerce plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability. This occurs through the use of the 'color' shortcode attribute, where inadequate input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts can execute on any page accessed by users, potentially compromising user data and site integrity. It is vital for WordPress plugin users to apply updates and implement security best practices to mitigate such vulnerabilities.

Affected Version(s)

Customer Reviews for WooCommerce 0 <= 5.113.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/customer-revie...
https://plugins.trac.wordpress.org/browser/customer-revie...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Athiwat Tiprasaharn (Jitlada)
Itthidej Aramsri (Boeing777)
.