VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Customer Reviews for WooCommerce security & vulnerabilities

customer-reviews-woocommerce— active installsLast vulnerability Nov 12, 2026

No known unpatched vulnerabilities in the latest version

All 31 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
31Known vulnerabilities
  • Critical1
  • High7
  • Medium23
  • Low0
Vulnerabilities per year
2022: 3 vulnerabilities3222023: 7 vulnerabilities7232024: 6 vulnerabilities6242025: 1 vulnerability1252026: 14 vulnerabilities1426

All Customer Reviews for WooCommerce vulnerabilities

Customer Reviews for WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Sensitive Information Exposure in 'search' Parameter
≤5.127.0Update to 5.128.0
CVE-2026-121518
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
≤5.126.0Update to 5.127.0
CVE-2026-120553
High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
≤5.122.0Update to 5.123.0
CVE-2026-97663
Critical9.1Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
≤5.120.0Update to 5.121.0
CVE-2026-89055
Medium5.3Missing Authorization
≤5.120.0Update to 5.121.0
CVE-2026-96823
High7.2Unauthenticated Stored Cross-Site Scripting
<5.118.0Update to 5.118.0
CVE-2026-76585
High7.2Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
≤5.106.0Update to 5.107.0
CVE-2026-6176
Medium4.3Missing Authorization
≤5.115.0Update to 5.116.0
CVE-2026-14941
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
≤5.113.0Update to 5.114.0
CVE-2026-13771
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.110.1Update to 5.111.0
CVE-2026-56043
Medium6.1Reflected Cross-Site Scripting via 'crsearch'
≤5.101.0Update to 5.102.0
CVE-2026-3355
Medium5.3Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
≤5.103.0Update to 5.104.0
CVE-2026-4664
High7.2Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
≤5.97.0Update to 5.98.0
CVE-2026-1316
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
≤5.93.1Update to 5.94.0
CVE-2025-14891
Medium6.4Unauthenticated Stored Cross-Site Scripting via `author` Parameter
≤5.80.2Update to 5.81.0
CVE-2025-5720
Medium4.3Missing Authorization to Authenticated (Subscriber+) Import Cancellation
≤5.61.0Update to 5.62.0
CVE-2024-10614
Medium6.1Reflected Cross-Site Scripting via 's'
≤5.47.0Update to 5.48.0
CVE-2024-3731
Medium4.3Missing Authorization to Authenticated (Subscriber+) Coupon Search
≤5.46.0Update to 5.47.0
CVE-2024-3869
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
≤5.46.0Update to 5.47.0
CVE-2024-3243
Medium5.3Improper Authorization via submit_review
≤5.38.12Update to 5.39.0
CVE-2024-1044
High8.8Authenticated (Author+) Arbitrary File Upload
≤5.38.9Update to 5.38.10
CVE-2023-6979
Medium5.3Missing Authorization via CR_Manual
≤5.38.1Update to 5.38.2
CVE-2023-51692
Medium4.3Missing Authorization via manual review reminders
<5.38.2Update to 5.38.2
—
Medium4.3Cross-Site Request Forgery via manual review reminders
<5.38.2Update to 5.38.2
—
Medium5.4Missing Authorization in Reviews Exporter
≤5.36.0Update to 5.36.1
CVE-2023-45101
Medium4.3Missing Authorization
<5.36.1Update to 5.36.1
—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.16.0Update to 5.17.0
CVE-2023-0079
High8.1Authenticated (Subscriber+) Local File Inclusion
≤5.15.0Update to 5.16.0
CVE-2023-0080
Medium4.3Sensitive Data Exposure
≤5.3.5Update to 5.3.6
CVE-2022-40194
Medium5.4Cross-Site Request Forgery
≤5.3.5Update to 5.3.6
CVE-2022-38470
Medium5.4Multiple Unprotected AJAX Actions
≤5.3.5Update to 5.3.6
CVE-2022-38134

Customer Reviews for WooCommerce: common questions

Does Customer Reviews for WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 31 known vulnerabilities in Customer Reviews for WooCommerce: 1 critical, 7 high, 23 medium. None are known to affect version null.

How do I check which version of Customer Reviews for WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Customer Reviews for WooCommerce vulnerability?

CVE-2026-121518, published Nov 12, 2026: Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter. Severity: Medium (CVSS 5.3).

Is any Customer Reviews for WooCommerce vulnerability listed in CISA KEV?

No. None of the known Customer Reviews for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?