Photo Reviews for WooCommerce: Unauthenticated stored DOM-based XSS
Summary
The Photo Reviews for WooCommerce WordPress plugin up to and including version 1.2.30 does not sanitize or escape the 'wcpr_image_upload_id' parameter. An unauthenticated visitor can store a script in review comment meta, which is not filtered by wp_kses, and it runs in the browser of anyone who views the affected review. The only gate is a nonce that is printed on every product review form, and no authentication or ownership check is performed.
Affected
- Photo Reviews for WooCommerce plugin, all versions up to and including 1.2.30
- CVSS 7.2 (v3.1, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
Fixed in
Unknown. No vendor advisory or changelog naming a fixed version was found. Do not assume that 1.2.31 is safe for this CVE.
Workaround
- No vendor-published workaround was found.
- A web application firewall with XSS rules may reduce exploitation attempts (third-party suggestion, not vendor-confirmed).
- Limit wp-admin review moderation to trusted accounts until a fix is installed.
- Review existing review entries and their stored image metadata for unexpected markup.
Exploitation
- Not listed in the CISA KEV catalogue.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- No public proof-of-concept or exploit known in the sources reviewed.
- EPSS score 0.00262 according to Vulners.
Our recommendation
- Inventory whether the plugin is installed and which version is active.
- If public reviews with photo upload are used, disable the review photo upload feature or the plugin until a fixed version is confirmed.
- Restrict review moderation in wp-admin to trusted accounts and check reviews with images for unexpected markup.
- Monitor the WordPress.org changelog and the Wordfence advisory for an official fixed version and install it promptly.
- Priority: medium to high for shops with public reviews.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- WordPress.org plugin listing vi.wordpress.org
- VulDB CVE entry vuldb.com
- OpenCVE entry app.opencve.io
- Vulners Rapid7 entry (EPSS) vulners.com
- Plugin source frontend.php plugins.trac.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 05:47.
Original description (NVD)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The publicly-emitted `wcpr_image_upload` nonce printed on every product review form is the only gate, and no capability, authentication, or attachment ownership check is performed, allowing the payload to be stored in comment meta — which is not subject to `wp_kses` — by any unauthenticated visitor; the XSS fires once the review is visible on the frontend.
NVD references (5)
- https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/frontend/frontend.php#L1268
- https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/js/default-display-images.js#L17
- https://plugins.trac.wordpress.org/browser/woo-photo-reviews/trunk/templates/viwcpr-template-basic-html.php#L…
- https://vi.wordpress.org/plugins/woo-photo-reviews/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7b1e4f3b-071b-4ef7-9a07-f26da45b916e?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.