CVE-2026-100161 Overview
The Photo Reviews for WooCommerce plugin for WordPress contains a stored DOM-based Cross-Site Scripting vulnerability [CWE-79] in versions up to and including 1.2.30. The flaw resides in the wcpr_image_upload_id parameter, which lacks input sanitization and output escaping. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user views the affected review page. The plugin relies solely on the publicly emitted wcpr_image_upload nonce as its security gate, with no capability, authentication, or attachment ownership checks performed.
Critical Impact
Unauthenticated attackers can store malicious JavaScript in WooCommerce product reviews, executing arbitrary scripts in the browsers of all visitors viewing affected product pages.
Affected Products
- Photo Reviews for WooCommerce plugin (woo-photo-reviews) versions 1.2.30 and earlier
- WordPress installations running the vulnerable plugin
- WooCommerce stores displaying customer photo reviews on the frontend
Discovery Timeline
- 2026-10-10 - CVE-2026-100161 published to the National Vulnerability Database
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-100161
Vulnerability Analysis
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts through the product review submission form. The injected payload persists in the WordPress database and executes in the browser of any visitor who loads the affected product page. Because the XSS is stored and triggers on normal page loads, it can impact administrators, authenticated customers, and anonymous visitors alike. Scope is Changed per the CVSS vector, reflecting the ability to affect browser sessions beyond the vulnerable application boundary. Successful exploitation can enable session hijacking, credential theft via injected forms, or forced administrative actions when a privileged user views the review.
Root Cause
The plugin accepts the wcpr_image_upload_id parameter without applying input sanitization or output escaping. The payload is stored in WordPress comment meta, which is not processed through wp_kses filtering during output. The only control gating the upload endpoint is the publicly emitted wcpr_image_upload nonce, which is printed on every product review form and therefore trivially retrievable. The plugin omits capability checks, user authentication validation, and attachment ownership verification.
Attack Vector
An unauthenticated attacker retrieves the wcpr_image_upload nonce from any publicly accessible product review form. The attacker then submits a crafted request to the upload endpoint containing a malicious payload in the wcpr_image_upload_id parameter. The payload is stored in comment meta associated with a product review. When any user subsequently loads the product page, the JavaScript loader at js/default-display-images.js and the template at templates/viwcpr-template-basic-html.php render the unsanitized value into the DOM, triggering script execution.
See the WordPress Plugin Frontend Code, WordPress Plugin JavaScript Code, and WordPress Plugin Template Code for the vulnerable code paths.
Detection Methods for CVE-2026-100161
Indicators of Compromise
- Unexpected <script>, <img onerror=>, or event handler strings stored in WordPress commentmeta entries associated with wcpr_image_upload_id.
- Anomalous POST requests to the plugin's image upload endpoint originating from unauthenticated sessions or automated clients.
- Outbound requests from browsers to attacker-controlled domains after loading a product review page.
- New or modified administrative accounts following administrator visits to product review pages.
Detection Strategies
- Query the WordPress database for commentmeta rows containing the wcpr_image_upload_id key and inspect values for HTML or JavaScript syntax.
- Monitor web server access logs for unauthenticated POST requests referencing the plugin's upload action.
- Deploy a web application firewall rule to flag review submissions containing script tags, javascript: URIs, or common XSS payload patterns.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on product pages.
- Alert on administrator session activity immediately following views of product review content.
- Correlate plugin endpoint traffic with user-agent and IP reputation data to identify automated abuse.
How to Mitigate CVE-2026-100161
Immediate Actions Required
- Deactivate the Photo Reviews for WooCommerce plugin until a patched version is installed.
- Audit existing product reviews and comment meta for stored script payloads and remove malicious entries.
- Rotate credentials for any administrator accounts that may have loaded a compromised review page.
- Review the Wordfence Vulnerability Report for the latest patch availability.
Patch Information
At the time of publication, the vendor had not released a confirmed patched version addressing CVE-2026-100161. Monitor the Woo Photo Reviews Plugin Page for updates beyond version 1.2.30 and apply the fix as soon as it becomes available.
Workarounds
- Disable public photo uploads in the plugin settings if the configuration option is available.
- Deploy WAF rules blocking requests to the plugin's upload endpoint from unauthenticated users.
- Require authentication and completed purchase verification before allowing review submissions through WooCommerce core settings.
- Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
# Configuration example: disable the plugin via WP-CLI pending a patch
wp plugin deactivate woo-photo-reviews
# Audit comment meta for stored payloads
wp db query "SELECT comment_id, meta_key, meta_value FROM wp_commentmeta WHERE meta_key LIKE '%wcpr_image_upload_id%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
