CVE-2026-6176: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ivole Customer Reviews for WooCommerce

CVE-2026-6176 describes a stored cross-site scripting vulnerability in the Customer Reviews for WooCommerce plugin for WordPress, affecting versions up to and including 5.106.0. The vulnerability occurs because the plugin accepts review submissions from unauthenticated users via the 'cr_local_forms_submit' AJAX action without properly sanitizing HTML content before storing it with wp_insert_comment(). Later, the stored content is rendered on product pages using comment_text() without adequate escaping, allowing injection of arbitrary scripts. The attack vector requires a valid review form URL, which can be obtained from review reminder emails sent to customers.

An unauthenticated attacker can inject malicious scripts into product review comments, which are then executed in the browsers of users viewing the affected product pages. This can lead to information disclosure and integrity impacts such as session hijacking or defacement. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges required, and no user interaction needed, with impact on confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to review form URLs and monitor for suspicious review submissions. Avoid exposing review reminder emails publicly. Follow vendor guidance once an official fix or update is released.