CVE-2026-76585: CWE-79 Cross-Site Scripting (XSS) in Customer Reviews for WooCommerce

CVE-2026-76585 is a Stored Cross-Site Scripting (CWE-79) vulnerability in the Customer Reviews for WooCommerce WordPress plugin prior to version 5.118.0. The flaw arises because the plugin does not sanitize or escape the content of customer reviews received through one of its endpoints. This allows unauthenticated attackers to inject malicious scripts that are stored and executed in the context of users viewing the reviews, potentially leading to full compromise of user data and site integrity. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and full confidentiality, integrity, and availability impact. No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported.

Successful exploitation could allow unauthenticated attackers to perform stored XSS attacks, leading to execution of arbitrary scripts in the browsers of users viewing the customer reviews. This can result in theft of sensitive information, session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability of the affected site and its users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable endpoint or applying custom input sanitization and output escaping as a temporary mitigation.