The Customer Reviews for WooCommerce plugin suffers from a reflected cross-site scripting vulnerability via the 's' parameter due to improper input neutralization during web page generation. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The issue affects all plugin versions up to 5.47.0. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user session data, perform actions on behalf of users, or conduct phishing attacks. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and no authentication, increasing the risk to site visitors but not to the server itself. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 's' parameter. Additionally, advise users to avoid clicking suspicious links related to the affected site. Monitor vendor channels for updates and apply patches promptly once available.