Stored XSS in Customer Reviews for WooCommerce Plugin

The Customer Reviews for WooCommerce plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-97663, impacting all versions up to and including 5.122.0. The vulnerability stems from inadequate sanitization of user-supplied data in the 'Comment Author Name' field. An unauthenticated attacker can exploit this when the plugin's image attachment functionality is active. By leveraging the 'wp_ajax_nopriv_cr_upload_local_images_frontend' endpoint alongside the 'ivole_attach_image' parameter, an attacker can submit a review containing an entity-encoded malicious script. When an unsuspecting user or administrator views a page where this review is displayed, the payload executes within their browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or the theft of sensitive session data. Organizations using this plugin should verify if the image attachment feature is enabled and ensure the plugin is updated to a patched version beyond 5.122.0 once available.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user viewing the affected WordPress page. This typically results in full account compromise if the victim is an administrator, enabling the attacker to modify site content, redirect users to malicious sites, or deploy further backdoors within the WordPress environment.

Recommendation

• Audit the WordPress environment to confirm if the Customer Reviews for WooCommerce plugin is in use and identify if the image attachment feature is enabled.
• Patch the plugin immediately upon the release of version 5.123.0 or later by the vendor.
• Implement a Web Application Firewall (WAF) rule to inspect and block requests to the 'wp-admin/admin-ajax.php' endpoint where the query parameter 'action' is set to 'cr_upload_local_images_frontend' and the request body contains anomalous script-like payloads in the author name or attachment parameters.
• Disable the image attachment feature for reviews if it is not a strictly required business function until the patch can be applied.