Security Alert Summary
The Customer Reviews for WooCommerce plugin before 5.118.0 does not sanitise and escape review content submitted via one of its endpoints. This weakness can allow unauthenticated users to store malicious JavaScript in reviews, leading to Stored Cross-Site Scripting (XSS) affecting visitors and authenticated users who view the review content.
CVE Details
- CVE ID: CVE-2026-76585
- Affected component: Customer Reviews for WooCommerce (WordPress plugin)
- Affected versions: Versions before 5.118.0 (version < 5.118.0)
- Published: August 30, 2026 at 7:17:20 AM UTC
- Last modified: August 30, 2026 at 7:17:20 AM UTC
- CVSS v3.1 base score, severity, vector: Not provided in the CVE metadata
- Authentication requirements / Privileges required / User interaction: Not provided in the CVE metadata (the description states the issue can be triggered by unauthenticated users)
- Primary impact:
- Confidentiality: Possible exposure of sensitive data from users browsing affected pages (e.g., cookies or other data accessible to client-side scripts).
- Integrity: Ability for an attacker to inject or modify content presented to users via injected scripts.
- Availability: Direct impact to availability is not indicated; service disruption is not the primary effect of this vulnerability.
- CWE / weakness ID: Not provided in the CVE metadata
Technical Details
The plugin fails to sanitise and escape the content of customer reviews received via one of its endpoints. Because input is stored and later rendered to visitors without proper output encoding, an attacker can submit a review containing malicious JavaScript. When that stored review is displayed to other users, the browser will execute the injected script (Stored Cross-Site Scripting).
The CVE description does not name specific PHP functions, JavaScript functions, or REST endpoints. It only indicates that one of the plugin endpoints accepts review content that is not properly sanitised or escaped. The core issue is missing input validation and output encoding for data that is stored and later rendered in HTML contexts.
Impact is limited to what a browser-executed script can achieve in the context of a viewing user: executing actions on behalf of the user within the site UI, reading data accessible to client-side scripts, or redirecting users to external pages. The information provided does not indicate server-side code execution or automatic full-site compromise.
How This Could Impact Your Website
Consider a small team running a WooCommerce store: the site owner, an internal content editor, and an external contractor who helps manage reviews. An unauthenticated attacker could submit a crafted review that contains executable JavaScript. When the site owner, editor, or contractor views the page listing that review, the malicious script could run in their browser.
- Internal user email addresses or other data shown on the page could be exposed to the attacker if client-side scripts can access them.
- Attackers could attempt targeted phishing or social engineering by using scripts to display fake messages or capture user interactions.
- Editors or administrators might unknowingly perform actions while a malicious script runs in their session, increasing risk but not necessarily implying full server compromise.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor or other roles that can submit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and review logs for unusual behavior, including unexpected content submissions or changes.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
