CVE-2025-5720: WooCommerce Customer Reviews XSS Vulnerability

CVE-2025-5720 Overview

CVE-2025-5720 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Customer Reviews for WooCommerce plugin for WordPress. The flaw exists in all versions up to and including 5.80.2 and stems from insufficient input sanitization and output escaping on the author parameter. Authenticated attackers with low-level privileges can inject arbitrary JavaScript that executes when any user views the affected page. The issue is tracked under [CWE-79] and was reported through the Wordfence vulnerability program.

Critical Impact
Injected scripts execute in the browser context of site administrators and visitors, enabling session hijacking, credential theft, and redirection to attacker-controlled infrastructure.

Affected Products

Customer Reviews for WooCommerce plugin for WordPress
All versions up to and including 5.80.2
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2025-07-31 - CVE-2025-5720 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5720

Vulnerability Analysis

The vulnerability resides in the plugin's reviews list handling code, specifically in class-cr-reviews-list-table.php. The author parameter passed to the reviews list rendering logic is written into the resulting HTML without adequate sanitization or output escaping. Because the tainted value is persisted with the review record, the injected payload becomes a stored XSS that fires each time an administrator or visitor loads the affected page.

Stored XSS in an e-commerce context is particularly consequential. WooCommerce administrators routinely view review lists, so a payload placed by a low-privileged actor can execute in a highly privileged browser session. Attackers can chain the flaw to exfiltrate authentication cookies, pivot into the WordPress admin, or plant additional persistence via plugin or theme modification.

Root Cause

The root cause is missing input validation and improper output encoding on the author parameter within the reviews list table rendering routine. The plugin trusts user-supplied review metadata and echoes it into administrative and public views without applying WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses(). See the code references at lines 1033, 1052, and 1073.

Attack Vector

An attacker submits a review or interacts with the review workflow in a way that sets the author field to a crafted payload containing HTML or JavaScript. The payload is stored in the WordPress database. When an administrator opens the reviews list in wp-admin or when a public page renders the affected content, the browser parses and executes the injected script under the site's origin. Exploitation requires network access to the WordPress site and does not require user interaction beyond viewing an affected page.

No verified public exploit code is available for CVE-2025-5720. Refer to the Wordfence Vulnerability Report for the disclosure details.

Detection Methods for CVE-2025-5720

Indicators of Compromise

Review records where the author field contains HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or javascript: URIs.
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after opening the WooCommerce reviews list.
New or modified WordPress administrator accounts created shortly after an admin viewed the reviews page.
Unexplained modifications to wp_options, active theme files, or mu-plugins immediately following review page access.

Detection Strategies

Query the WordPress database for review author values containing angle brackets, on* event handlers, or encoded script markers.
Deploy Web Application Firewall (WAF) rules that inspect the author parameter for HTML and JavaScript syntax on plugin endpoints.
Enable Content Security Policy (CSP) reporting to capture unexpected inline script execution on WooCommerce admin pages.
Review web server access logs for POST requests to review submission endpoints containing URL-encoded script payloads such as %3Cscript%3E.

Monitoring Recommendations

Alert on creation or modification of WordPress administrator accounts from unusual source IPs.
Monitor plugin file integrity and generate alerts when Customer Reviews for WooCommerce files are altered outside a patch window.
Track browser telemetry from privileged workstations for unexpected script execution and cross-origin data transfer from wp-admin URLs.

How to Mitigate CVE-2025-5720

Immediate Actions Required

Upgrade the Customer Reviews for WooCommerce plugin to a version newer than 5.80.2 that includes the vendor fix.
Audit existing review records for stored payloads and sanitize or delete any entries containing HTML or scripting content.
Rotate WordPress administrator credentials and invalidate active sessions if the plugin has been in use unpatched.
Restrict review submission to authenticated accounts and apply rate limiting on review endpoints.

Patch Information

Apply the vendor patch released after version 5.80.2. Consult the Wordfence Vulnerability Report and the plugin changelog for the exact fixed version and remediation notes. Verify the update on a staging environment before production rollout.

Workarounds

Temporarily deactivate the Customer Reviews for WooCommerce plugin until the patched version is applied.
Enforce a strict Content Security Policy that blocks inline script execution within wp-admin and public product pages.
Deploy WAF signatures that reject requests containing script tags or event-handler attributes in the author parameter.
Limit administrator access to trusted networks and require multi-factor authentication for WordPress admin accounts.

bash

# Example WP-CLI commands to identify and remove the plugin pending patching
wp plugin status customer-reviews-woocommerce
wp plugin deactivate customer-reviews-woocommerce

# Search review records for suspicious author values
wp db query "SELECT comment_ID, comment_author FROM wp_comments WHERE comment_author REGEXP '<|javascript:|onerror=|onload=';"