Skip to content
fr Sign in
6.4 Medium

CVE-2026-120553 Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute

Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Customer Reviews for WooCommerce 5.126 earliest → 5.126.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Customer Reviews for WooCommerce

The 16 CVEs of Customer Reviews for WooCommerce →
CVE-2026-97663 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment… 7.2 High CVE-2026-89055 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,… 9.1 Critical CVE-2026-6176 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… 7.2 High CVE-2026-13771 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color'… 6.4 Medium
Track this CVE