CVE-2026-97663 is a stored cross-site scripting vulnerability in the Customer Reviews for WooCommerce plugin for WordPress. The flaw arises from insufficient input sanitization and output escaping of the comment author name field. Attackers can exploit this by submitting a review with an entity-encoded malicious author name and uploading an attached image via the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint, provided the image attachment feature (ivole_attach_image) is enabled. This vulnerability affects all plugin versions from 0 up to and including 5.122.0.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of the affected site whenever a user accesses the injected page. This can lead to information disclosure and manipulation of web content (confidentiality and integrity impacts). Availability is not affected. The vulnerability has a CVSS 3.1 score of 7.2 (High) with network attack vector, low attack complexity, no privileges or user interaction required, and scope changed.

No official patch or fix is currently referenced in the provided data. Users should check the vendor advisory for updates. Until a fix is available, disabling the image attachment feature (ivole_attach_image) may mitigate the attack vector by preventing unauthenticated image uploads and review submissions that exploit this vulnerability.