The Customer Reviews for WooCommerce plugin suffers from a reflected cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, the 'crsearch' parameter is not properly sanitized or escaped, enabling attackers to inject malicious scripts that execute when a user interacts with a crafted link. This vulnerability affects all plugin versions up to 5.101.0. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity but no impact on availability. No vendor-provided patch or official remediation is currently documented.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser session when the victim clicks a malicious link. This can lead to theft of sensitive information, session hijacking, or other actions permitted by the victim's privileges in the affected web application. The vulnerability does not impact system availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'crsearch' parameter in the affected plugin. Consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to this parameter. Monitor vendor channels for updates and apply patches promptly once released.