CVE-2026-1316: WooCommerce Customer Reviews XSS Flaw

CVE-2026-1316 Overview

CVE-2026-1316 is a stored Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 5.97.0. It stems from insufficient input sanitization and output escaping on the media[].href parameter. When the 'Enable for Guests' setting is active, unauthenticated attackers can inject arbitrary web scripts that execute in the browser of any user who views the affected page. The issue is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into review pages, enabling session theft, credential harvesting, and redirection of WooCommerce shoppers when 'Enable for Guests' is enabled.

Affected Products

Customer Reviews for WooCommerce plugin for WordPress
All versions up to and including 5.97.0
WordPress sites with the 'Enable for Guests' option enabled

Discovery Timeline

2026-02-12 - CVE-2026-1316 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1316

Vulnerability Analysis

The vulnerability resides in how the Customer Reviews for WooCommerce plugin processes the media[].href parameter submitted with customer reviews. The plugin accepts user-supplied media references but fails to sanitize the value on input and fails to escape it on output. As a result, attacker-controlled HTML and JavaScript persist in the database and render unsanitized when shoppers, administrators, or guests load the affected product or review page. Because the 'Enable for Guests' configuration allows unauthenticated submissions, the attack requires no account, no privileges, and no user interaction beyond viewing the page. The scope-changed CVSS metric reflects that scripts execute in the victim's browser context, crossing the trust boundary from the plugin to the WordPress site visitor.

Root Cause

The root cause is missing input validation and missing output escaping on the media[].href field. The plugin trusts the attribute as a URL without enforcing a safe scheme or stripping HTML entities. Standard WordPress sanitizers such as esc_url() and esc_attr() are not applied before rendering the value in markup.

Attack Vector

An attacker submits a crafted review containing a media[].href value that embeds a JavaScript payload, for example using a javascript: URI or HTML attribute breakout. The malicious value is stored alongside the review. When a victim loads the page containing the review, the browser parses the unescaped attribute and executes the payload under the site's origin. Refer to the Wordfence Vulnerability Report and the WordPress plugin changeset for the corrective code.

Detection Methods for CVE-2026-1316

Indicators of Compromise

Review records containing javascript:, data:, or <script substrings in the media[].href field stored in the wp_comments or plugin-specific tables.
Outbound requests from visitor browsers to unknown domains shortly after loading product review pages.
Unexpected administrator session activity or password resets following review submissions from unauthenticated users.

Detection Strategies

Query the WordPress database for stored review media entries and flag any href value that does not begin with http:// or https://.
Monitor WordPress access logs for POST requests to review submission endpoints from unauthenticated sources containing encoded script payloads.
Deploy a Web Application Firewall (WAF) rule that inspects review submission parameters for XSS signatures targeting media[].href.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations on review and product pages.
Audit plugin and theme inventories regularly to confirm Customer Reviews for WooCommerce is updated past version 5.97.0.
Forward WordPress and WAF telemetry into a centralized SIEM for correlation against review submission spikes.

How to Mitigate CVE-2026-1316

Immediate Actions Required

Update the Customer Reviews for WooCommerce plugin to the version published in changeset 3446777, which is the release following 5.97.0.
Temporarily disable the 'Enable for Guests' setting until the plugin is patched to prevent unauthenticated review submissions.
Review existing reviews for stored payloads and purge any entries containing script content in media[].href.

Patch Information

The vendor remediated the issue in the commit referenced by WordPress plugin changeset 3446777. Site administrators should upgrade to the first plugin release published after this changeset. Validate the running version through the WordPress Plugins screen after applying the update.

Workarounds

Disable the Customer Reviews for WooCommerce plugin until the patched version is deployed.
Deploy a WAF rule that rejects review submissions where media[].href contains characters outside a strict URL allowlist.
Enforce a strict Content Security Policy that blocks inline script execution on store pages.

bash

# Configuration example: WP-CLI commands to verify and update the plugin
wp plugin status customer-reviews-woocommerce
wp plugin update customer-reviews-woocommerce
wp option get cr_cusrev_enable_for_guests
wp option update cr_cusrev_enable_for_guests 'no'