Aller au contenu
en Se connecter
7.2 Élevée

CVE-2026-6176 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it via wp_insert_comment(), and later renders this stored content on product pages through comment_text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.

Produits et versions touchés

Produit Versions touchées Corrigé en
Customer Reviews for WooCommerce 5.106 premières → 5.106.0 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Customer Reviews for WooCommerce

Les 16 CVE de Customer Reviews for WooCommerce →
CVE-2026-120553 Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute 6.4 Moyenne CVE-2026-97663 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment… 7.2 Élevée CVE-2026-89055 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to,… 9.1 Critique CVE-2026-13771 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color'… 6.4 Moyenne
Suivre cette CVE