CVE-2026-6176

CVE-2026-6176 is a stored cross-site scripting (CWE-79) vulnerability in the Customer Reviews for WooCommerce WordPress plugin, present in all versions up to and including 5.106.0, caused by insufficient input sanitization and output escaping of user-supplied review comment text. An unauthenticated attacker who has a valid review form URL - normally a customer who received one of the plugin's review reminder emails after placing an order - can submit a crafted review through the 'cr_local_forms_submit' AJAX action, and the plugin stores the unsanitized HTML in a comment via wp_insert_comment(). When that review is later rendered on a product page through comment_text(), the injected script executes in the browser of anyone who views the page, letting the attacker run arbitrary JavaScript to steal session data, redirect shoppers, or alter page content. Any WooCommerce store running the plugin at version 5.106.0 or earlier is affected - especially stores that send aggregated review invitation emails - and the flaw is rated High severity (CVSS 3.1: 7.2) with confidentiality and integrity impact but no availability impact. No public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.3% chance of exploitation within 30 days) indicate that exploitation has not yet been observed.

What to do: Update Customer Reviews for WooCommerce to a release later than 5.106.0 (the patched version published by the developer) on all WooCommerce stores, prioritizing shops that use review reminder emails. As an interim mitigation, disable or restrict the aggregated review form and its reminder-email links, and audit existing review comments for embedded HTML or script tags. Because no public proof-of-concept or in-the-wild exploitation is known, this can be handled on a normal patch cycle while monitoring for the fixed release.