An unauthenticated attacker can exploit this by submitting malicious scripts within review comments. By leveraging legitimate review form URLs, typically delivered via email to previous customers, an attacker can inject scripts that execute in the browser of any user who views the compromised product page. Successful exploitation may lead to session hijacking, unauthorized actions performed on behalf of authenticated administrators or users, or redirection to malicious sites.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of victim browsers. This poses a significant risk to WordPress sites using the plugin, particularly if administrative accounts view the affected product pages. Potential consequences include account takeover, credential theft, and unauthorized site modifications.

Recommendation

• Upgrade the 'Customer Reviews for WooCommerce' plugin to the latest version immediately to patch CVE-2026-6176.
• Audit existing product comments for unexpected HTML or script tags if the site was running version 5.106.0 or earlier.
• Implement or strengthen Content Security Policy (CSP) headers to restrict the execution of unauthorized inline scripts.