Stored Cross-Site Scripting in Customer Reviews for WooCommerce

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.106.0. The vulnerability stems from the plugin's 'cr_local_forms_submit' AJAX action, which fails to adequately sanitize user-supplied review content before it is stored in the database via the 'wp_insert_comment' function. Furthermore, the plugin fails to perform proper output escaping when rendering this content on product pages using 'comment_text()'.

An unauthenticated attacker can exploit this by submitting malicious scripts within review comments. By leveraging legitimate review form URLs, typically delivered via email to previous customers, an attacker can inject scripts that execute in the browser of any user who views the compromised product page. Successful exploitation may lead to session hijacking, unauthorized actions performed on behalf of authenticated administrators or users, or redirection to malicious sites.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of victim browsers. This poses a significant risk to WordPress sites using the plugin, particularly if administrative accounts view the affected product pages. Potential consequences include account takeover, credential theft, and unauthorized site modifications.

Recommendation

• Upgrade the 'Customer Reviews for WooCommerce' plugin to the latest version immediately to patch CVE-2026-6176.
• Audit existing product comments for unexpected HTML or script tags if the site was running version 5.106.0 or earlier.
• Implement or strengthen Content Security Policy (CSP) headers to restrict the execution of unauthorized inline scripts.