CVE-2026-6176: WooCommerce Customer Reviews XSS Vulnerability

CVE-2026-6176 Overview

CVE-2026-6176 is a stored Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 5.106.0. Unauthenticated attackers holding a valid review form URL can inject arbitrary JavaScript through the aggregated review submission form. The plugin fails to sanitize HTML in review comment text before storage and does not escape the content when rendering it on product pages. Any visitor loading the affected product page executes the attacker-controlled script in their browser session. The issue is tracked under [CWE-79] and stems from the cr_local_forms_submit AJAX handler.

Critical Impact
Unauthenticated stored XSS allows script execution against every visitor of an affected WooCommerce product page, including administrators.

Affected Products

Customer Reviews for WooCommerce plugin for WordPress
Versions up to and including 5.106.0
WooCommerce storefronts using the plugin's aggregated review form and reminder email flow

Discovery Timeline

2026-08-28 - CVE-2026-6176 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-6176

Vulnerability Analysis

The vulnerability resides in the plugin's aggregated review submission workflow. The cr_local_forms_submit AJAX action accepts review data from unauthenticated requests. The handler passes user-supplied comment text into wp_insert_comment() without stripping or sanitizing HTML markup. Product pages later render the stored comment through comment_text() without escaping, producing a persistent script execution primitive. Because the injected payload is stored server-side, every subsequent visit to the affected product page triggers the script in the visitor's browser context. Successful exploitation enables session theft, forced administrative actions through CSRF chaining, credential harvesting via injected forms, and browser-based redirection to attacker infrastructure.

Root Cause

The root cause is insufficient input sanitization on ingress and missing output escaping on egress. The plugin trusts unauthenticated review submissions and stores raw HTML instead of applying WordPress helpers such as wp_kses_post() or sanitize_text_field(). The rendering path compounds the issue by emitting stored content without esc_html() or equivalent escaping.

Attack Vector

Exploitation requires a valid review form URL. Attackers obtain this URL through review reminder emails sent by the store to customers who placed orders. Once the URL is known, the attacker submits a crafted review containing JavaScript payloads to the cr_local_forms_submit endpoint. The payload persists on the product review page and executes for every subsequent visitor, including administrators logged into wp-admin. No authentication or user interaction beyond visiting the product page is required for downstream victims.

See the WordPress WooCommerce AJAX Class and WordPress WooCommerce Review Endpoint for the vulnerable code paths.

Detection Methods for CVE-2026-6176

Indicators of Compromise

Comment rows in the wp_comments table containing <script>, onerror=, onload=, or javascript: tokens within comment_content.
POST requests to admin-ajax.php with the action=cr_local_forms_submit parameter originating from non-customer IP addresses.
Outbound requests from browsing sessions on product pages to unfamiliar third-party domains hosting JavaScript.
New administrative users or modified user roles created shortly after an administrator visited a product review page.

Detection Strategies

Query the WordPress database for stored comments containing HTML event handlers or <script> tags posted through the plugin's aggregated form.
Correlate web server access logs for repeated cr_local_forms_submit submissions tied to a single order token or referrer.
Deploy a web application firewall (WAF) rule that inspects AJAX POST bodies for script injection patterns targeting the plugin action name.

Monitoring Recommendations

Monitor WordPress audit logs for unexpected comment creation events attributed to guest submitters.
Alert on modifications to plugin files under wp-content/plugins/customer-reviews-woocommerce/.
Track browser telemetry for anomalous script loads on WooCommerce product pages, particularly connections to untrusted domains.

How to Mitigate CVE-2026-6176

Immediate Actions Required

Update the Customer Reviews for WooCommerce plugin to the version published in WordPress Changeset #3510305 or later.
Audit the wp_comments table and remove any stored comments containing script tags or JavaScript event handlers.
Rotate administrator session cookies and reset credentials for accounts that accessed affected product pages before patching.
Review recent changes to WordPress users, roles, and installed plugins for signs of compromise.

Patch Information

The vendor addressed the vulnerability in the release corresponding to WordPress Changeset #3510305. Site owners should upgrade beyond version 5.106.0. Consult the Wordfence Vulnerability Analysis for additional remediation guidance.

Workarounds

Disable the Customer Reviews for WooCommerce plugin until the patched version is installed.
Restrict access to admin-ajax.php requests carrying action=cr_local_forms_submit at the WAF layer.
Suspend the review reminder email feature to prevent distribution of valid review form URLs to potential attackers.
Enforce a strict Content Security Policy (CSP) on the storefront to limit execution of inline and third-party scripts.

bash

# Configuration example: WP-CLI plugin update and audit
wp plugin update customer-reviews-woocommerce
wp db query "SELECT comment_ID, comment_post_ID, comment_author FROM wp_comments WHERE comment_content REGEXP '<script|onerror=|onload=|javascript:';"