Customer Reviews for WooCommerce vulnerabilities | LiveThreat CVE Feed

Product

Customer Reviews for WooCommerce

by ivole · last CVE Oct 2, 2026

CVEs

On KEV

9.1

Max CVSS

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 1High 4Medium 10Low 0

Severity

All severities15 Critical1 High4 Medium10 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Customer Reviews for WooCommerce to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-89055	9.1	1%	Sep 25	Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter Affected: through 5.120.0
CVE-2023-6979	8.8	1%	Jan 11	Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload Affected: through 5.38.9
CVE-2026-97663	7.2	0%	Oct 2	Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name Affected: through 5.122.0
CVE-2026-6176	7.2	0%	Aug 28	Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form Affected: through 5.106.0
CVE-2026-1316	7.2	0%	Feb 12	Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter Affected: through 5.97.0
CVE-2026-13771	6.4	0%	Jul 9	Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute Affected: through 5.113.0
CVE-2025-14891	6.4	0%	Jan 7	Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter Affected: through 5.93.1
CVE-2025-5720	6.4	0%	Jul 31	Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter Affected: through 5.80.2
CVE-2026-3355	6.1	0%	Apr 16	Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch' Affected: through 5.101.0
CVE-2024-3731	6.1	0%	Apr 19	Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's' Affected: through 5.47.0
CVE-2026-4664	5.3	1%	Apr 10	Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter Affected: through 5.103.0
CVE-2024-1044	5.3	0%	Feb 20	Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review Affected: through 5.38.12
CVE-2024-10614	4.3	0%	Nov 16	Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation Affected: through 5.61.0
CVE-2024-3243	4.3	0%	Apr 16	Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending Affected: through 5.46.0
CVE-2024-3869	4.3	0%	Apr 16	Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search Affected: through 5.46.0