CVE-2026-76585

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Customer Reviews for WooCommerce Plugin

Publication date: 2026-08-30

Last updated on: 2026-08-31

Assigner: WPScan

Description

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-30

Last Modified

2026-08-31

Generated

2026-09-19

AI Q&A

2026-08-30

EPSS Evaluated

2026-09-15

NVD

CVE-2026-76585

EUVD

EUVD-2026-68157

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	customer_reviews	to 5.118.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Customer Reviews for WooCommerce WordPress plugin before version 5.118.0. It allows unauthenticated users to inject malicious scripts into customer reviews via a plugin endpoint. These scripts are stored on the server and executed when other users view the affected reviews.

Detection Guidance

Check the installed version of the Customer Reviews for WooCommerce plugin. If it is below 5.118.0, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

Attackers could steal user sessions, redirect users to malicious sites, or perform actions on behalf of users. This could lead to data theft, account compromise, or spreading malware. Users viewing infected reviews may unknowingly execute harmful scripts.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing user data through script injection. GDPR requires protection against unauthorized data access, while HIPAA mandates safeguards for sensitive health information. A breach could result in legal penalties.

Mitigation Strategies

Update the Customer Reviews for WooCommerce plugin to version 5.118.0 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Hi! I’m here to help you understand CVE-2026-76585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70