Description

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-19T08:16:50.633Z",
  "pubdate": "2026-09-19T08:16:50.633Z",
  "executiveSummary": "The WP Customer Reviews plugin, versions 3.7.8 and earlier, contains a Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper input sanitization and output escaping within the 'wpcr3_fname' parameter.\nThe vulnerability allows an unauthenticated, remote attacker to inject arbitrary client-side scripts into the user's browser context. The execution of these malicious scripts is contingent upon a successful social engineering effort, such as enticing an authenticated user to interact with a specifically crafted malicious URL.\nIf successfully exploited, the vulnerability enables the attacker to execute unauthorized JavaScript in the context of the victim's session. This may lead to the theft of session cookies, sensitive information disclosure, or the performance of actions on behalf of the victim within the WordPress administrative interface or site frontend. Given the potential for session hijacking, this flaw represents a significant risk to site integrity and user data confidentiality.\nThe vulnerability requires no authentication or special privileges for initiation, but success is dependent on user interaction. Remediation is necessary to ensure secure handling of user-supplied data.",
  "technicalDetails": "The vulnerability is classified as Reflected Cross-Site Scripting (XSS), stemming from the application's failure to adequately sanitize and encode the 'wpcr3_fname' parameter before rendering it in the HTTP response. The 'wpcr3_fname' parameter is processed by the plugin without sufficient validation, allowing an attacker to supply malicious input containing HTML tags and JavaScript event handlers.\nThe exploitation flow begins when an attacker identifies a vulnerable entry point where the 'wpcr3_fname' parameter is reflected back to the user's browser. The attacker crafts a malicious URL containing a JavaScript payload designed to execute upon rendering. This payload is then embedded within a link that the attacker distributes to target users.\nWhen a victim, particularly one with elevated privileges such as an administrator, clicks the crafted link, the malicious request is sent to the web server. The vulnerable WordPress site receives this request and processes the 'wpcr3_fname' parameter. Because the plugin does not implement proper output escaping, the server returns the payload directly in the HTML response. The victim's browser, interpreting the server's response, executes the script within the origin of the vulnerable domain.\nThe scope of this vulnerability allows for the execution of arbitrary scripts in the victim's browser session. By hijacking the session, an attacker can bypass authorization controls, potentially modify site configurations, delete reviews, or execute administrative actions if the victim is logged in as an administrator. Furthermore, the attacker could redirect users to malicious third-party websites or perform credential harvesting through DOM manipulation. Because the payload is reflected, it does not require persistent storage on the server, making it a transient but potent vector for client-side attacks. The issue remains present in all versions up to and including 3.7.8, requiring developers to implement strict input validation and appropriate context-aware output encoding functions, such as esc_attr() or esc_html(), to ensure user-supplied data cannot be interpreted as executable code by the browser."
}