PT-2026-1554 · Unknown+1 · Woocommerce+1

Angus Girvan · CVE-2025-14891 · Published 2026-01-07 · Updated 2026-01-07

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce plugin for WordPress versions prior to 5.93.2

Description The Customer Reviews for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through the displayName parameter. Insufficient input sanitization and output escaping allows authenticated attackers with customer-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. While invoking the AJAX action typically requires authentication, an attacker could potentially bypass this requirement if guest checkout is enabled and a valid form ID is obtained through placing an order.

Recommendations Update the Customer Reviews for WooCommerce plugin to version 5.93.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14891

Affected Products

Customer Reviews For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14891 · Security Note
• https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19 · Note
• https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76 · Note
• https://t.me/CVEtracker/41563 · Telegram Post
• https://twitter.com/CVEnew/status/2008771283883094340 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve · Note