Customer Reviews for WooCommerce

CVE Details

Basic Information

Title	Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter
Type	cve
Published	2025-07-31T04:26:20.602Z
Modified	2025-07-31T04:26:20.602Z

Product Information

Vendor	ivole
Product	Customer Reviews for WooCommerce
Version	*

CVSS Information

Base Score	6.4 (MEDIUM)
Attack Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Analysis

AI Description	A stored XSS vulnerability in the Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject scripts via the ‘author’ parameter, potentially executing when users access the page.
AI Severity	Medium
AI Vendor	WordPress Community
AI Product	Customer Reviews for WooCommerce
AI Version	All versions up to 5.80.2
AI Score	6.4

Affected Products

ivole Customer Reviews for WooCommerce *

Additional Information

CWE List	CWE-79
Source	Wordfence

Description

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

View Full CVE Details