CVE-2026-97663: Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivoleattachimage) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the publicly accessible wpajaxnoprivcruploadlocalimagesfrontend endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the image attachment feature (ivole_attach_image), which is required for the unauthenticated attack.
Customer Reviews for WooCommerce ivole_attach_image = disabled
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites using Customer Reviews for WooCommerce version 5.122.0 or earlier are exposed if the image attachment feature, ivole_attach_image, is enabled. The vulnerable review and image-upload path is publicly accessible, so an attacker does not need an account.
What does an attacker need to do to exploit this issue?
The attacker must be able to submit a review using an entity-encoded malicious author name and upload an attached image through the public wp_ajax_nopriv_cr_upload_local_images_frontend endpoint. No authentication or user interaction is required for the injection itself.
What is the impact after a malicious review is submitted?
Arbitrary web script can be stored in the affected content and executes when a user visits an injected page. The disclosed impact includes confidentiality and integrity effects, with scope changed.
What mitigation is available if updating is not immediately possible?
Disable the ivole_attach_image image attachment feature. The described unauthenticated exploitation path requires that feature to be enabled.