The Customer Reviews for WooCommerce plugin allows attackers with at least subscriber‑level access, or occasionally unauthenticated users when guest checkout is turned on, to inject arbitrary JavaScript using the displayName parameter. The developer fails to sanitize this input or escape it when rendering, so the payload is stored and executed every time any user loads the affected form page. The flaw is a classic Stored XSS (CWE‑79) and can lead to session hijacking, defacement, or phishing of other site visitors.

The vulnerability exists in all Customer Reviews for WooCommerce releases up to and including version 5.93.1. Sites that use this WordPress plugin—any WordPress installation where the plugin is active—are in scope. No other vendors or products are listed.

The listed CVSS score of 6.4 indicates moderate severity, and an EPSS figure of less than 1 % suggests low observed exploit activity so far. Because the flaw requires form data to be stored, an attacker must place a form submission to acquire a valid form ID; this limits the immediate reach but still poses a risk, especially when guest checkout facilitates order creation by unauthenticated users. The vulnerability is not in CISA KEV, and no official fix is referenced in the provided CNA data, but the change set link implies an upstream fix exists in a newer release. Attackers can exploit this via the AJAX endpoint or by direct form submission, as inferred from the code references.