CVE-2026-100161: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in villatheme Photo Reviews for WooCommerce

CVE-2026-100161 describes a stored DOM-based cross-site scripting vulnerability in the Photo Reviews for WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.30. The vulnerability is due to improper neutralization of input in the 'wcpr_image_upload_id' parameter, allowing unauthenticated attackers to inject arbitrary web scripts into product review pages. The plugin emits a publicly accessible nonce 'wcpr_image_upload' on every product review form, but does not enforce capability, authentication, or attachment ownership checks. Consequently, attackers can store malicious payloads in comment meta fields that bypass WordPress's standard content sanitization functions like wp_kses. The XSS payload executes when the review is displayed on the frontend, potentially impacting confidentiality and integrity of user sessions or data.

An unauthenticated attacker can inject and store malicious scripts in product reviews, which execute in the browsers of users viewing those reviews. This can lead to theft of user credentials, session hijacking, or other malicious actions within the context of the affected site. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction needed, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor the use of the Photo Reviews for WooCommerce plugin, especially the review submission functionality. Consider disabling or restricting unauthenticated review submissions or applying custom input sanitization and output escaping for the 'wcpr_image_upload_id' parameter. Monitor vendor channels for updates and apply official patches promptly once released.