CVE-2026-13771: Stored XSS in Customer Reviews for WooCommerce Plugin Up to 5.113.0

Technical summary

CVE-2026-13771 is a Stored XSS vulnerability (CWE-79) in the Customer Reviews for WooCommerce plugin caused by insufficient input sanitization and output escaping in the 'color' shortcode attribute. The vulnerability requires authentication and contributor-level privileges to exploit. An attacker can inject arbitrary JavaScript that persists in the WordPress database and executes in the context of any user viewing the affected page. The CVSS 3.1 score of 6.4 (MEDIUM) reflects network-accessible attack vector, low complexity, low privilege requirements, and cross-site scope with limited confidentiality and integrity impact.

Business impact

Organizations using WooCommerce with the Customer Reviews plugin risk unauthorized modification of page content, session hijacking, credential theft, and malware distribution through trusted product pages. For e-commerce operators, this threatens customer trust, payment security, and compliance obligations (PCI-DSS, GDPR). The stored nature means the attack persists until remediated, affecting all subsequent page visitors rather than single-session exploits.

Affected systems

WordPress installations running the Customer Reviews for WooCommerce plugin in version 5.113.0 or earlier are vulnerable. The attack surface is limited to authenticated users with contributor role or above, though the impact affects any visitor to compromised pages. Multisite WordPress deployments may face broader risk if contributor access is delegated across sites.

Exploitability

Exploitation requires existing WordPress account credentials with contributor, author, editor, or administrator role. No network-level attack or user interaction is needed beyond the initial injection. The vulnerability is straightforward to exploit once access is obtained—a malicious actor simply uses the affected shortcode with injected script payload in the color attribute. The low complexity and absence of special conditions make this a practical risk in environments with delegated content creation workflows.

Remediation

Update the Customer Reviews for WooCommerce plugin to a patched version released after 5.113.0. Verify the fix version against the official WordPress plugin repository and the vendor's security advisory. In the interim, restrict contributor-level access to trusted users and audit existing content for suspicious color attributes in customer review shortcodes. Consider using a Web Application Firewall (WAF) rule to block shortcode injection patterns.

Patch guidance

Check the Customer Reviews for WooCommerce plugin repository and vendor advisories for the patched version addressing this flaw. Update via WordPress admin dashboard (Plugins > Updates) once a fix is available. Before updating, back up your database and test on a staging environment to ensure compatibility with your active shortcodes and custom configurations. Document the update and review any recent changes to product review pages.

Detection guidance

Search WordPress post and page content for 'color' attributes in customer review shortcodes containing unusual JavaScript syntax, event handlers (onclick, onerror), or script tags. Monitor WordPress revision history for unexpected modifications to pages containing this shortcode. Use WordPress security plugins to audit contributor-level edits. In database queries, look for posts_meta entries referencing the affected shortcode with suspicious base64 encoding or HTML entity patterns. Review access logs for contributor accounts accessing post edit screens around the time of suspected injection.

Why prioritize this

Although rated MEDIUM severity, prioritize this vulnerability in environments with distributed content creation (agency partners, franchisees, external contributors). Stored XSS affecting customer-facing pages poses reputational and compliance risk. Organizations must patch within 30 days if contributor access is actively delegated, or within 60 days for single-admin sites. Threat actors may target WooCommerce stores specifically to inject malicious redirects or credential-harvesting forms.

Risk score, explained

The CVSS 3.1 base score of 6.4 reflects: Network-accessible attack surface (AV:N), low attack complexity (AC:L), and low privilege barrier (PR:L—contributor role is readily assigned). The score assumes cross-site scope (S:C), meaning the XSS can affect browsers outside the original vulnerable component. Confidentiality and Integrity are scored as Low (C:L, I:L) because the attacker can read and modify page content visible to other users but cannot directly access system data or authentication tokens. Availability is Not Affected (A:N) because the attack does not degrade service. Organizations with high-value product pages or regulated content should treat this as HIGH priority despite the MEDIUM base score.

Frequently asked questions