The Customer Reviews for WooCommerce plugin contains a stored cross‑site scripting flaw. Unsanitized review text submitted through the "cr_local_forms_submit" AJAX action is saved with wp_insert_comment() and later rendered on product pages without escaping, enabling an attacker to inject arbitrary JavaScript. The result can include defacement, phishing, or credential theft within users’ browsers. The weakness arises from insufficient input validation and output encoding, which maps to CWE‑79.

The vulnerability affects the ivole Customer Reviews for WooCommerce plugin version 5.106.0 and all earlier releases. Any site running one of these versions is susceptible; later versions are presumed fixed.

The CVSS base score is 7.2, indicating a high severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. An attacker can exploit the flaw without authentication by submitting a malicious review through the exposed AJAX endpoint; the review form URL is discoverable from order reminder emails. Because the attack vector relies on normal website traffic and requires no privileges, the practical risk of exploitation is substantial.