VULNERABILITY INTELLIGENCE
CVE-2026-76585
CVSS score8.8 HIGH
EPSS probability0.51%
CISA KEVNot currently listed
Published2026-08-30
Last modified2026-08-31
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
Weakness classification
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')