Plugin icon

Customer Reviews for WooCommerce

customer-reviews-woocommerce

Vulnerabilities:

18

Last Updated:

March 30, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2026-02-12
Title
Customer Reviews for WooCommerce < 5.98.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
Fixed in
Fixed in 5.98.0
CVSS
7.2 (high)
Published
2026-01-06
Title
Customer Reviews for WooCommerce < 5.94.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
Fixed in
Fixed in 5.94.0
CVSS
6.4 (medium)
Published
2025-07-30
Title
Customer Reviews for WooCommerce < 5.81.0 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter
Fixed in
Fixed in 5.81.0
CVSS
6.4 (medium)
Published
2024-11-15
Title
Customer Reviews for WooCommerce < 5.62.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation
Fixed in
Fixed in 5.62.0
CVSS
4.3 (medium)
Published
2024-04-18
Title
Customer Reviews for WooCommerce < 5.48.0 - Reflected Cross-Site Scripting via 's'
Fixed in
Fixed in 5.48.0
CVSS
6.1 (medium)
Published
2024-04-15
Title
Customer Reviews for WooCommerce < 5.47.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Fixed in
Fixed in 5.47.0
CVSS
4.3 (medium)
Published
2024-04-15
Title
Customer Reviews for WooCommerce < 5.47.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search
Fixed in
Fixed in 5.47.0
CVSS
4.3 (medium)
Published
2024-02-06
Title
Customer Reviews for WooCommerce < 5.39.0 - Improper Authorization via submit_review
Fixed in
Fixed in 5.39.0
CVSS
5.3 (medium)
Published
2024-01-09
Title
Customer Reviews for WooCommerce < 5.38.10 - Author+ Arbitrary File Upload
Fixed in
Fixed in 5.38.10
CVSS
7.2 (high)
Published
2023-11-19
Title
Customer Reviews for WooCommerce < 5.38.2 - Cross-Site Request Forgery via manual review reminders
Fixed in
Fixed in 5.38.2
CVSS
4.3 (medium)
Published
2023-11-19
Title
Customer Reviews for WooCommerce < 5.38.2 - Missing Authorization via manual review reminders
Fixed in
Fixed in 5.38.2
CVSS
4.3 (medium)
Published
2023-10-06
Title
Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization in Reviews Exporter
Fixed in
Fixed in 5.36.1
CVSS
5.4 (medium)
Published
2023-10-04
Title
Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization
Fixed in
Fixed in 5.36.1
CVSS
4.3 (medium)
Published
2023-01-24
Title
Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS
Fixed in
Fixed in 5.17.0
CVSS
6.8 (medium)
Published
2023-01-23
Title
Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI
Fixed in
Fixed in 5.16.0
CVSS
9.1 (critical)
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Cross-Site Request Forgery
Fixed in
Fixed in 5.3.6
CVSS
4.3 (medium)
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Unauthenticated Sensitive Information Disclosure
Fixed in
Fixed in 5.3.6
CVSS
5.3 (medium)
Published
2022-09-22
Title
Customer Reviews for WooCommerce < 5.3.6 - Broken Access Control
Fixed in
Fixed in 5.3.6
CVSS
4.3 (medium)