Unauthenticated users can inject malicious scripts into the WordPress Customer Reviews for WooCommerce plugin, allowing them to execute code in the context of site visitors. This type of vulnerability, identified as CWE-79, can lead to session hijacking, defacement, or the delivery of malware to users. The impact is containment of the plugin’s output handling, enabling arbitrary script execution on affected sites.

The vulnerability affects the CusRev:Customer Reviews for WooCommerce plugin, versions 5.110.1 or earlier. The plugin is commonly deployed on WordPress sites that use WooCommerce to display customer feedback. No other vendors or products are listed as impacted.

The CVSS score of 7.1 indicates a high severity level, but the EPSS score is not available, so the current likelihood of exploitation is uncertain. The issue is not listed in CISA’s KEV catalog. Because the flaw is unauthenticated, anyone can trigger it by crafting a payload that is stored in a review or other user-generated content field and then view the page that displays that content. Once the malicious script runs, it can perform actions in the victim’s browser session.