Stored Cross-Site Scripting Vulnerability in Customer Reviews for WooCommerce Plugin by WordPress
CVE-2026-97663

7.2HIGH

Key Information:

Vendor

WordPress
Status
Customer Reviews For WooCommerce
Vendor
CVE Published:
2 October 2026

What is CVE-2026-97663?

The Customer Reviews for WooCommerce plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability. This vulnerability arises from insufficient validation of the Comment Author Name field, allowing unauthenticated attackers to inject malicious scripts. When the image attachment feature is enabled, these attackers can submit reviews containing encoded harmful scripts. Once injected, these scripts execute when users visit affected pages, potentially compromising their security by executing untrusted code.

Affected Version(s)

Customer Reviews for WooCommerce 0 <= 5.122.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/customer-revie...
https://plugins.trac.wordpress.org/browser/customer-revie...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

crow
.