CVE-2026-11608: WP Customer Reviews XSS Vulnerability

CVE-2026-11608 Overview

The WP Customer Reviews plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability in the wpcr3_fname parameter. All versions up to and including 3.7.8 are affected. The flaw stems from insufficient input sanitization and output escaping in the plugin's frontend review form. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim is tricked into clicking a crafted link. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, or redirection to attacker-controlled sites.

Affected Products

WP Customer Reviews plugin for WordPress, versions up to and including 3.7.8
WordPress sites using the vulnerable plugin with the frontend review form enabled
Any WordPress deployment that renders the wpcr3_fname parameter without patched sanitization

Discovery Timeline

2026-09-19 - CVE-2026-11608 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-11608

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw in the WP Customer Reviews plugin. The wpcr3_fname request parameter is echoed back into the frontend review form template without adequate escaping. When a victim visits a URL containing an attacker-controlled payload in that parameter, the browser parses the reflected content as executable HTML or JavaScript. Because the vulnerability requires user interaction and results in scope change with limited confidentiality and integrity impact, it is scored as a network-exploitable issue with reduced severity relative to persistent XSS. The EPSS probability places this vulnerability in the lower range of expected exploitation, but public plugin code and a Wordfence advisory make weaponization straightforward for any competent attacker.

Root Cause

The root cause is missing output escaping in the frontend_review_form_text_field.html template, combined with insufficient sanitization in wp-customer-reviews-3.php. Referenced code paths at lines 257, 272, and 1051 pass the wpcr3_fname value into a rendered HTML value attribute without applying esc_attr() or a comparable WordPress escaping function. See the WordPress Plugin Template Code and the WordPress Customer Reviews PHP Code for the affected sinks.

Attack Vector

An attacker crafts a URL to a page hosting the vulnerable review form, embedding a malicious payload in the wpcr3_fname query parameter. The attacker delivers the URL via phishing email, chat, or a malicious referrer. When the target clicks the link, the WordPress site renders the payload inside the review form field, and the injected script executes under the site's origin. Because the attack is reflected and unauthenticated, no prior access to the target site is required. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component within the browser context.

No verified public exploit code is available. Technical details are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-11608

Indicators of Compromise

Web server access logs containing wpcr3_fname= values with URL-encoded HTML tags such as %3Cscript%3E, onerror=, or javascript: schemes
Referrers from unexpected external domains pointing at pages that host the WP Customer Reviews form
Browser console errors or Content Security Policy violations originating from pages using the review form shortcode

Detection Strategies

Inspect HTTP request logs for the wpcr3_fname parameter and flag values containing angle brackets, quote characters, or event handler attributes
Deploy a Web Application Firewall (WAF) rule that blocks known XSS payload patterns on requests targeting WordPress pages containing the review form
Perform authenticated scans of WordPress installations to identify sites running WP Customer Reviews version 3.7.8 or earlier

Monitoring Recommendations

Enable WordPress audit logging to record plugin versions and configuration changes
Correlate web request telemetry with endpoint browser process events to identify script execution triggered by reflected payloads
Monitor for outbound network connections from browsers to unexpected domains immediately following visits to WordPress review pages

How to Mitigate CVE-2026-11608

Immediate Actions Required

Identify all WordPress sites running the WP Customer Reviews plugin and confirm the installed version
Update the plugin to a version newer than 3.7.8 once the vendor publishes a fixed release
Disable or deactivate the WP Customer Reviews plugin on affected sites until a patched version is deployed

Patch Information

A plugin changeset has been recorded in the WordPress plugin repository. Review the WordPress Plugin Changeset Update for the specific code changes. Site administrators should upgrade to the latest available version of WP Customer Reviews through the WordPress admin dashboard and validate the plugin version in production after deployment.

Workarounds

Deploy a WAF rule to block requests containing suspicious characters or scripts in the wpcr3_fname parameter
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering the review form
Remove the [WPCR_SHOW] shortcode from public pages until the plugin is patched

bash

# Example WAF rule (ModSecurity) to block XSS payloads in wpcr3_fname
SecRule ARGS:wpcr3_fname "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026116080,phase:2,deny,status:403,\
     msg:'CVE-2026-11608 WP Customer Reviews XSS attempt blocked'"