WordPress Plugin Vulnerabilities

Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

Description

The plugin does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
customer-reviews-woocommerce
Fixed in 5.118.0

References

CVE
CVE-2026-76585

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
rasul
Submitter
rasul
Verified
Yes
WPVDB ID
7d539fba-d47e-461d-b40f-1aa8f535d506

Timeline

Publicly Published
2026-08-28 (about 2 days ago)
Added
2026-08-28 (about 1 day ago)
Last Updated
2026-08-28 (about 1 day ago)

Other

Published
Title
Published
2023-10-02
Title
Locations <= 4.0 - Contributor+ Stored XSS
Published
2025-02-11
Title
FuseDesk < 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-08
Title
SEMA API < 5.30 - Reflected Cross-Site Scripting via catid Parameter
Published
2024-05-27
Title
Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS
Published
2026-05-07
Title
WEN Logo Slider < 3.5 - Authenticated (Author+) Stored Cross-Site Scripting