Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it via wp_insert_comment(), and later renders this stored content on product pages through comment_text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T16:18:21.580Z",
  "pubdate": "2026-08-28T16:18:21.580Z",
  "executiveSummary": "The Customer Reviews for WooCommerce plugin for WordPress, in versions up to and including 5.106.0, contains a critical Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability stems from inadequate input sanitization and output escaping within the plugin's review submission mechanism.\nUnauthenticated attackers can exploit this flaw by submitting malicious JavaScript payloads through the 'cr_local_forms_submit' AJAX action.\nOnce injected, the script is stored in the database and automatically executed in the browser of any user, including administrators, who visits the affected product page where the comment is rendered.\nThis poses a severe security risk, as successful exploitation could lead to session hijacking, unauthorized actions on behalf of the victim, or the theft of sensitive session cookies.\nThe attack is facilitated by the plugin's failure to sanitize user-supplied comment text before storage and the subsequent failure to escape the content when processed via 'comment_text()' for rendering.\nExploitation requires knowledge of a valid review form URL, which can be acquired via review reminder emails sent to customers.",
  "technicalDetails": "The vulnerability resides in the interaction between the 'cr_local_forms_submit' AJAX action and the WordPress database storage mechanism.\nWhen a user submits a review via the aggregated review form, the plugin processes the input but fails to apply robust sanitization filters (such as 'wp_kses_post' or 'sanitize_textarea_field') to the review body content before it is passed to 'wp_insert_comment()'.\nBecause 'wp_insert_comment()' is a core WordPress function that typically handles content as provided, the raw, malicious input—containing embedded <script> tags or other dangerous HTML elements—is committed directly to the 'wp_comments' table in the database.\nThe vulnerability is further exacerbated during the rendering phase. When a product page is loaded, the plugin utilizes the 'comment_text()' function to display review comments. Because the stored data was never sanitized upon entry, the browser interprets the malicious payload as valid, executable code rather than plain text.\nThe attack flow proceeds as follows: An unauthenticated attacker obtains a valid review form URL, typically delivered via the plugin's automated review request system. The attacker crafts an HTTP POST request targeting the 'cr_local_forms_submit' AJAX endpoint, injecting a malicious JavaScript payload into the comment text parameter. The server accepts this request, and the plugin persists the payload into the database without validation. When a victim (a customer or site administrator) views the product page, the server fetches the malicious string from the database and echoes it into the page source. The victim's browser executes the script within the context of the WordPress site's origin.\nThis creates a persistent XSS condition that does not require further interaction from the attacker once the payload is injected. The impact includes the ability to perform actions within the victim's session, capture sensitive data, or redirect users to malicious domains. The flaw exists in the handling of all versions up to 5.106.0 and affects the primary comment submission flow of the plugin."
}