CVE-2026-97663: Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

Q: Which sites are exposed to unauthenticated exploitation?

Sites using Customer Reviews for WooCommerce version 5.122.0 or earlier are exposed if the image attachment feature, ivole_attach_image, is enabled. The vulnerable review and image-upload path is publicly accessible, so an attacker does not need an account.

Q: What does an attacker need to do to exploit this issue?

The attacker must be able to submit a review using an entity-encoded malicious author name and upload an attached image through the public wp_ajax_nopriv_cr_upload_local_images_frontend endpoint. No authentication or user interaction is required for the injection itself.

Q: What is the impact after a malicious review is submitted?

Arbitrary web script can be stored in the affected content and executes when a user visits an injected page. The disclosed impact includes confidentiality and integrity effects, with scope changed.

Q: What mitigation is available if updating is not immediately possible?

Disable the ivole_attach_image image attachment feature. The described unauthenticated exploitation path requires that feature to be enabled.

Published Oct 2, 2026

Updated

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivoleattachimage) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wpajaxnoprivcruploadlocalimagesfrontend endpoint.

Affected Software

1 affected component

CusRev Customer Reviews for WooCommerce<=5.122.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the image attachment feature (ivole_attach_image), which is required for the unauthenticated attack.
Customer Reviews for WooCommerce ivole_attach_image = disabled

Event History

Oct 2, 2026

CVE Published

via MITRE·07:39 AM

Data Sourced

via MITRE·07:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

Sites using Customer Reviews for WooCommerce version 5.122.0 or earlier are exposed if the image attachment feature, ivole_attach_image, is enabled. The vulnerable review and image-upload path is publicly accessible, so an attacker does not need an account.

What does an attacker need to do to exploit this issue?

The attacker must be able to submit a review using an entity-encoded malicious author name and upload an attached image through the public wp_ajax_nopriv_cr_upload_local_images_frontend endpoint. No authentication or user interaction is required for the injection itself.

What is the impact after a malicious review is submitted?

Arbitrary web script can be stored in the affected content and executes when a user visits an injected page. The disclosed impact includes confidentiality and integrity effects, with scope changed.

What mitigation is available if updating is not immediately possible?

Disable the ivole_attach_image image attachment feature. The described unauthenticated exploitation path requires that feature to be enabled.

CVE-2026-97663: Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need to do to exploit this issue?

What is the impact after a malicious review is submitted?

What mitigation is available if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to unauthenticated exploitation?

What does an attacker need to do to exploit this issue?

What is the impact after a malicious review is submitted?

What mitigation is available if updating is not immediately possible?