CVE-2026-100161
Received Received - Intake

Stored DOM-Based XSS in Photo Reviews for WooCommerce Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The publicly-emitted `wcpr_image_upload` nonce printed on every product review form is the only gate, and no capability, authentication, or attachment ownership check is performed, allowing the payload to be stored in comment meta — which is not subject to `wp_kses` — by any unauthenticated visitor; the XSS fires once the review is visible on the frontend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-100161
EUVD
EUVD-2026-96216

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
villatheme Photo Reviews for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability in the Photo Reviews for WooCommerce WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the 'wcpr_image_upload_id' parameter due to insufficient input sanitization and output escaping. The injected scripts execute when users access affected pages. The vulnerability bypasses typical WordPress security measures because the payload is stored in comment meta, which is not subject to wp_kses filtering.

Detection Guidance

This vulnerability is specific to the Photo Reviews for WooCommerce WordPress plugin. To detect it, check if your WordPress site uses version 1.2.30 or older of the plugin. Inspect the plugin files for the 'wcpr_image_upload_id' parameter in review submission forms. Look for stored XSS payloads in comment meta or review content that may execute when pages load.

Impact Analysis

Unauthenticated attackers could inject malicious scripts into your WooCommerce store's review pages. When visitors view these pages, the scripts could steal cookies, session tokens, or sensitive data, or perform actions on their behalf. This could lead to account takeovers, data breaches, or defacement of your website.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches that require reporting under these regulations, potentially leading to fines or legal consequences for non-compliance.

Mitigation Strategies

Update the Photo Reviews for WooCommerce plugin to the latest version beyond 1.2.30 to address the Stored DOM-Based Cross-Site Scripting vulnerability. Remove or disable the plugin if no update is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart