CVE-2026-120553: Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidestoshow' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Contributor-level access. They must be able to submit content containing the affected shortcode and its slides_to_show attribute.
What happens when the malicious content is viewed?
The injected script is stored in a page and executes in the browser of users who access that page. The issue can affect confidentiality and integrity in the viewing user’s browser context.
How can I determine whether my site may be affected?
Sites using Customer Reviews for WooCommerce version 5.126.0 or earlier may be affected. Review content created by Contributor-level and higher accounts for use of the relevant shortcode with a suspicious slides_to_show attribute.