CVE-2026-100161 in Photo Reviews for WooCommerce Plugin
Summary
by MITRE • 10/10/2026
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The publicly-emitted `wcpr_image_upload` nonce printed on every product review form is the only gate, and no capability, authentication, or attachment ownership check is performed, allowing the payload to be stored in comment meta — which is not subject to `wp_kses` — by any unauthenticated visitor; the XSS fires once the review is visible on the frontend.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within the Photo Reviews for WooCommerce plugin affects all versions up to and including 1.2.30, representing a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms. This specific weakness manifests as a Stored DOM-Based Cross-Site Scripting (XSS) vector triggered by the wcpr_image_upload_id parameter. Unlike transient XSS attacks that rely on immediate user interaction with malicious links, this vulnerability allows an attacker to persistently inject arbitrary web scripts into the application's database. The core technical failure lies in the plugin's handling of unauthenticated input; it accepts data from any visitor without verifying ownership or performing adequate validation before storing it within comment meta fields. Because WordPress typically applies strict sanitization functions like wp_kses to standard post content, attackers often target metadata areas that bypass these default protections, thereby creating a reliable persistence mechanism for malicious payloads.
The operational impact of this vulnerability is severe due to the lack of authentication requirements and capability checks during the storage phase. The plugin relies solely on a publicly emitted wcpr_image_upload nonce as its primary security gate. While nonces are designed to prevent Cross-Site Request Forgery by ensuring that requests originate from legitimate forms, they do not inherently validate user identity or permissions in this context. Consequently, any unauthenticated visitor can submit the review form with maliciously crafted parameters. Once submitted, the payload is stored directly into the database associated with a product review. This means that every subsequent user who views the affected product page will have their browser execute the injected JavaScript code automatically. The attack does not require social engineering or complex setup; it simply requires access to the public-facing frontend of the WordPress site where reviews are displayed.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing the payload in comment meta and executing it upon page load also relates to CWE-834, where session fixation or persistent state manipulation allows for prolonged exploitation. Furthermore, within the MITRE ATT&CK framework, this behavior maps to T1059.007, JavaScript Execution via Browser-based Web Browsers, specifically under the technique of Stored XSS. The attacker's ability to inject scripts that execute in the context of other users' sessions effectively compromises the confidentiality and integrity of those users. Depending on the browser environment and available extensions or cookies, this could lead to session hijacking, credential theft, defacement of the website, or even pivoting into further network intrusions if internal services are accessible from the user's machine.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade the Photo Reviews for WooCommerce plugin to a version later than 1.2.30 where these sanitization issues have been patched by the developers. If upgrading is not immediately feasible, administrators should consider disabling user-generated content features or restricting review submissions to authenticated users with specific capabilities until an update can be applied. Additionally, implementing a Web Application Firewall (WAF) with rules tuned for XSS detection can provide a layer of defense against exploitation attempts in real-time. Developers must ensure that all input parameters are strictly validated and sanitized using WordPress core functions before database insertion, and that output is properly escaped when rendered to the browser. Regular security audits focusing on meta data handling and nonce validation logic are essential to prevent similar vulnerabilities from being introduced in future updates or custom code modifications.