The Customer Reviews for WooCommerce plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the ‘author’ parameter. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages generated by the plugin. The issue affects all versions up to and including 5.80.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker can exploit this vulnerability to inject malicious scripts that execute in the context of users visiting the affected pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions limited to the confidentiality and integrity of user data. The attack requires no user interaction and can be performed remotely by an unauthenticated attacker. There is no known exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to pages that use the ‘author’ parameter. Applying web application firewall (WAF) rules to detect and block XSS payloads targeting this parameter may provide temporary mitigation.