PT-2026-1554 · Unknown+1 · Woocommerce+1

Angus Girvan · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-14891

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce plugin for WordPress versions prior to 5.93.2

Description The Customer Reviews for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the displayName parameter. Insufficient input sanitization and output escaping allows authenticated attackers with customer-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. While invoking the AJAX action typically requires authentication, an attacker could potentially bypass this requirement if guest checkout is enabled and a valid form ID is obtained through placing an order.

Recommendations Update the Customer Reviews for WooCommerce plugin to version 5.93.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-14891

Produtos afetados

Customer Reviews For Woocommerce

Woocommerce

Referências · 7

• https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19 · Nota
• https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76 · Nota
• https://t.me/CVEtracker/41563 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2008771283883094340 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14891 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve · Nota