CVE-2026-11608 in Customer Reviews Plugin
Summary
by MITRE • 09/19/2026
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The WP Customer Reviews plugin, widely utilized by WordPress site administrators to manage customer feedback and testimonials, contains a critical security flaw identified within versions up through 3.7.8. This vulnerability manifests as a Reflected Cross-Site Scripting issue centered specifically around the wpcr3_fname parameter. The root cause of this weakness lies in insufficient input sanitization combined with inadequate output escaping mechanisms during the processing and rendering of user-supplied data. When the plugin handles requests involving customer names, it fails to properly validate or encode the incoming information before incorporating it into the HTML response sent back to the client browser. This lack of rigorous validation allows malicious actors to inject executable JavaScript code directly into the page content without triggering server-side errors that might otherwise alert administrators to the intrusion attempt.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. The reflected nature of the attack means that the malicious script is not stored on the target server but is instead embedded within the HTTP response triggered by a specific user request. An attacker can craft a specially formatted URL containing the injected payload in the wpcr3_fname parameter and distribute it to potential victims through various social engineering vectors, such as phishing emails or compromised websites. When an unsuspecting user clicks this link while authenticated to their WordPress session, the browser interprets the embedded script as part of the legitimate page content, executing it within the security context of the vulnerable site.
The operational impact of exploiting this vulnerability is severe and multifaceted. Once executed, the malicious JavaScript can perform a variety of harmful actions on behalf of the victim user who holds administrative or elevated privileges on the WordPress installation. Attackers may steal session cookies to hijack active sessions, redirect users to phishing sites designed to capture credentials, deface the website by altering its visual presentation, or even install further malware such as keyloggers or browser-based crypto miners. Because the attack relies on user interaction via a link, it effectively bypasses many automated security controls that do not monitor outbound traffic or social engineering attempts. This capability significantly compromises the confidentiality and integrity of the web application and any data accessible to authenticated users.
In terms of threat classification, this vulnerability corresponds to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution within a browser environment. It also relates to initial access vectors where attackers leverage trusted relationships or user trust to gain entry into the system. The lack of proper encoding means that standard XSS filters may fail if they do not account for all possible injection points and context-specific escaping requirements, such as HTML attribute contexts versus body text contexts.
To mitigate this risk, immediate action is required by site administrators. The primary remediation step is to update the WP Customer Reviews plugin to version 3.7.9 or later, where these input validation and output encoding issues have been addressed by the developers. Until an upgrade can be performed, temporary mitigations include implementing a Web Application Firewall that filters out suspicious patterns in query parameters associated with known vulnerable endpoints. Additionally, enabling Content Security Policy headers can help restrict the execution of inline scripts, thereby reducing the impact if an injection attempt succeeds. Regular security audits and code reviews focusing on input sanitization practices are recommended to prevent similar vulnerabilities from being introduced into WordPress plugins or custom themes in the future.