CVE-2026-89055

CVE-2026-89055 — Customer Reviews for WooCommerce CusRev 認可バイパス Customer Reviews for WooCommerce （customer-reviews-woocommerce / Ivole CusRev）における CVE-2026-89055 の Python 3 PoC。 説明 PoCbit / GitHub CVE-2026-89055 — Customer Reviews for WooCommerce CusRev ≤ 5.120.0 は、公開されている ローカルレビューフォーム の AJAX...

CVE-2026-89055

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

EUVD-2026-86540

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-89055

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 5.120.0 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This flaw allows unauthenticated attacker...

CVE-2026-89055 Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

WordPress WP Customer Reviews plugin <= 3.7.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Quang in WordPress Plugin WP Customer Reviews versions = 3.7.8...

CVE-2026-11608

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-11608

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wpcr3_fname parameter in all versions up to and including 3.7.8 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that exe...

CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-83575

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-11608: Improper Neutralization of Input During Web Page Generation

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress Customer Reviews for WooCommerce plugin < 5.118.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by rasul in WordPress Plugin Customer Reviews for WooCommerce versions 5.118.0...

CVE-2026-76585

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

EUVD-2026-68157

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.118.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape the content of customer reviews received via one of the plugin's endpoints, specifically involving th...

PT-2026-83525

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585: Improper Neutralization of Input During Web Page Generation

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-6176

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...