CVE-2026-97663 in Customer Reviews for WooCommerce Plugin
Summary
by MITRE • 10/02/2026
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
The Customer Reviews for WooCommerce plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting, affecting all versions up to and including 5.122.0. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the application logic that handles user-generated content. Specifically, the defect resides in how the system processes the Comment Author Name field during the review submission process. Because the data is not properly validated or encoded before being stored in the database and subsequently rendered to other users, it allows for the injection of arbitrary web scripts. This type of vulnerability falls under CWE-79, which classifies improper neutralization of input during web page generation as a primary cause of cross-site scripting attacks.
The operational impact of this flaw is significant because it enables unauthenticated attackers to execute malicious JavaScript code in the context of any user who views the affected pages. Unlike reflected XSS where the payload must be delivered via a link, stored XSS persists on the server side, meaning every visitor to the page containing the injected script will trigger its execution automatically. This can lead to severe consequences such as session hijacking, credential theft, defacement of the website, or redirection to malicious sites that distribute malware. The persistence of the payload ensures widespread exposure without requiring further interaction from the attacker after the initial injection.
Exploitation of this vulnerability requires specific conditions related to the plugin's configuration and available endpoints. An attacker must have access to the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint, which is designed to handle image uploads for reviews but lacks adequate security controls in vulnerable versions. By leveraging this endpoint along with the enabled image attachment feature known as ivole_attach_image, an unauthenticated user can submit a review containing an entity-encoded malicious author name and attach an image file. The combination of these actions allows the attacker to bypass standard authentication requirements and inject the payload directly into the database through legitimate-looking API calls that are intended for normal user interactions.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, which covers Command and Scripting Interpretation, specifically within the context of web-based attacks. The attacker utilizes JavaScript execution to perform actions on behalf of victims, potentially leading to data exfiltration or further lateral movement if other systems are accessible from the victim's session. The use of entity encoding suggests that attackers may attempt to bypass basic filters by obfuscating their payloads before submission, highlighting the need for robust defense-in-depth strategies rather than relying solely on input validation.
To mitigate this risk, administrators should immediately update the Customer Reviews for WooCommerce plugin to a version newer than 5.122.0 where these sanitization and escaping issues have been addressed by the developers. If updating is not immediately feasible, temporary mitigations include disabling the image attachment feature if it is not strictly necessary for business operations, thereby removing the attack vector associated with the ivole_attach_image functionality. Additionally, implementing a Web Application Firewall can help detect and block requests that contain known malicious patterns or unusual encoding techniques commonly used in XSS attacks. Regular security audits and code reviews focusing on input handling and output rendering are essential to prevent similar vulnerabilities from being introduced in future updates.