CVE-2025-14891: WooCommerce Customer Reviews XSS Flaw

CVE-2025-14891 Overview

The Customer Reviews for WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the displayName parameter. This vulnerability affects all versions up to and including 5.93.1 and stems from insufficient input sanitization and output escaping. Authenticated attackers with customer-level access can inject arbitrary web scripts that execute whenever users access the compromised page.

Critical Impact

Attackers can inject persistent malicious scripts into WordPress pages, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users. The vulnerability is exploitable by unauthenticated attackers when guest checkout is enabled.

Affected Products

• Customer Reviews for WooCommerce plugin for WordPress versions up to and including 5.93.1
• WordPress installations with guest checkout enabled (unauthenticated exploitation possible)
• WooCommerce stores utilizing the Customer Reviews plugin review forms

Discovery Timeline

• 2026-01-07 - CVE CVE-2025-14891 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14891

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Customer Reviews for WooCommerce plugin's handling of the displayName parameter during review form submission. The vulnerability allows attackers to persist malicious JavaScript code within the WordPress database, which is subsequently rendered without proper sanitization when the affected pages are viewed.

The attack requires either authenticated access at the customer level or, alternatively, can be exploited by unauthenticated users when the WooCommerce store has guest checkout functionality enabled. In both scenarios, the attacker must obtain a valid form ID, which necessitates placing an order through the store to acquire this identifier.

The scope of the vulnerability is concerning as successful exploitation allows scripts to execute in the context of other users' browser sessions, including administrators, potentially leading to privilege escalation, data exfiltration, or further compromise of the WordPress installation.

Root Cause

The vulnerability originates from inadequate input validation and output encoding within the plugin's form processing logic. Specifically, the displayName parameter submitted through the AJAX action handler in class-cr-local-forms-ajax.php is not properly sanitized before storage, and the corresponding output in form-customer.php lacks appropriate escaping when rendering user-supplied content.

The relevant code paths can be examined in the WordPress Plugin AJAX Code and the WordPress Plugin Customer Form template files.

Attack Vector

The attack leverages the network-accessible review submission functionality. An attacker with network access to the WordPress site can submit a crafted review containing malicious JavaScript in the displayName field. The attack flow proceeds as follows:

1. The attacker places an order through the WooCommerce store (or uses guest checkout if available) to obtain a valid form ID
2. Using the acquired form ID, the attacker submits a review with XSS payload embedded in the displayName parameter
3. The malicious script is stored in the database without proper sanitization
4. When any user (including administrators) views the page containing the injected review, the malicious script executes in their browser context

The vulnerability can be exploited without requiring user interaction beyond viewing the affected page, and the injected scripts persist across page loads and user sessions.

Detection Methods for CVE-2025-14891

Indicators of Compromise

• Review entries containing JavaScript code or HTML event handlers in the displayName field
• Unusual patterns in WooCommerce review submissions, particularly those with <script> tags or on* event attributes
• Browser console errors or unexpected script execution on review pages
• Anomalous AJAX requests to the Customer Reviews plugin endpoints from external sources

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in POST parameters targeting WooCommerce review endpoints
• Monitor database entries in review-related tables for suspicious content patterns including encoded JavaScript
• Review server access logs for unusual POST requests to the plugin's AJAX handlers
• Deploy Content Security Policy (CSP) headers to restrict script execution and generate violation reports

Monitoring Recommendations

• Enable logging for all review submission activities within the Customer Reviews for WooCommerce plugin
• Configure SIEM alerts for XSS attack patterns in web application logs
• Regularly audit stored review content for potentially malicious payloads
• Monitor for changes in plugin files that might indicate exploitation or tampering

How to Mitigate CVE-2025-14891

Immediate Actions Required

• Update the Customer Reviews for WooCommerce plugin to a version newer than 5.93.1 immediately
• Review existing reviews in the database for potentially malicious content in the displayName field
• Consider temporarily disabling the review functionality if immediate patching is not possible
• Implement Web Application Firewall rules to filter XSS payloads in review submissions

Patch Information

The vendor has addressed this vulnerability in WordPress Plugin Changeset #3424980. Users should update to the latest version of the Customer Reviews for WooCommerce plugin available through the WordPress plugin repository.

For detailed vulnerability analysis and remediation guidance, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Disable guest checkout functionality to require authentication for form ID acquisition, reducing the attack surface
• Implement server-side input validation on the displayName parameter using WordPress sanitization functions
• Deploy Content Security Policy headers to mitigate the impact of successful XSS exploitation
• Restrict access to review submission functionality using IP allowlisting or CAPTCHA protection

# Example: Add Content Security Policy header to wp-config.php or .htaccess
# Apache .htaccess configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# Alternative: Add to WordPress functions.php
# add_action('send_headers', function() {
#     header("Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';");
# });