We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

Customer Reviews for WooCommerce Plugin Vulnerability (CVE-2026-6176)

Nick Paliughi
On this page

Security Alert Summary

The Customer Reviews for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to submit review content containing HTML or scripts via an aggregated review form. Stored content is saved without sufficient sanitization and later rendered on product pages without proper escaping, which can cause injected scripts to run in the context of users viewing affected product pages.

CVE Details

  • CVE ID: CVE-2026-6176
  • Affected component: Customer Reviews for WooCommerce plugin for WordPress
  • Affected versions: versions up to and including 5.106.0
  • Published: August 28, 2026, 4:18 PM UTC
  • Last modified: August 28, 2026, 4:18 PM UTC
  • CVSS v3.1: Base score 7.2, Severity: HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / privileges / user interaction: No authentication required, no privileges required, no user interaction required (per CVSS attributes)
  • Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting)

Technical Details

The plugin accepts review submissions from unauthenticated users through the cr_local_forms_submit AJAX action. User-supplied review comment text is not sufficiently sanitized before it is stored via wp_insert_comment(). Later, the stored comment content is rendered on product pages using comment_text() without proper escaping. Because HTML and script content can be stored and later output, an attacker with access to a valid review form URL can inject scripts that will execute when a visitor loads the affected product page.

The CVE description notes that a valid review form URL can be obtained from review reminder emails sent to customers who placed orders, making unauthenticated submission feasible for attackers who can retrieve such URLs. The core issue is missing input sanitization and missing escaping on output for stored review content, enabling stored XSS.

How This Could Impact Your Website

Consider a small ecommerce site with multiple users: a site owner, internal staff who manage orders and product listings, and external contractors who may help with marketing or content. An attacker who submits a crafted review could cause scripts to run when staff or customers visit the product page. Practical consequences include:

  • Exposure of data visible to the page context, such as customer session information or other data accessible in the browser session, consistent with the CVSS confidentiality and integrity impacts.
  • Changes to the visible product page content or insertion of deceptive UI elements that increase the risk of targeted phishing or social engineering against customers or staff.
  • Attackers with access to review form URLs (for example, obtained from review reminder emails) can submit payloads without authenticating, increasing the risk that automated or opportunistic attacks succeed.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributors or any role that can submit content.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins to reduce attack surface.
  • Monitor site activity and logs for unusual behavior, such as unexpected comments or form submissions, and review recent comments for suspicious content.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Everest Forms Plugin Vulnerability (CVE-2026-5096)
Next Post
Envira Gallery Plugin Vulnerability (CVE-2026-3423)