Customer Reviews for WooCommerce 存储型XSS漏洞(CVE-2026-13771)公告

漏洞概述 漏洞名称: Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute CVE ID: CVE-2026-13771 CVSS 评分: 6.4 (Medium) 公开日期: July 8, 2026 最后更新日期: July 9, 2026 研究人员: Athiwat Tiprasan (Jitada), Ithidej Araman (Boing777) 影响范围 软件类型: Plugin 软件标识: customer-reviews-woocommerce 受影响版本: <= 5.113.0 修复版本: 5.114.0 修复方案 修复措施: 更新到版本 5.114.0 或更高版本 漏洞描述 该漏洞允许经过身份验证的用户（贡献者及以上权限）通过 'color' 短代码属性注入恶意脚本，导致存储型跨站脚本攻击。攻击者可以利用此漏洞在页面上执行任意 JavaScript 代码，从而窃取用户数据或执行其他恶意操作。 参考链接 plugins.trac.wordpress.org 其他信息 最近发现的漏洞: - CVE-2026-56043: Customer Reviews for WooCommerce <= 5.110.1 - Unauthenticated Stored Cross-Site Scripting - CVE-2026-3355: Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'search' - CVE-2026-4664: Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authorization Bypass to Arbitrary Review Submission via key Parameter - CVE-2026-1316: Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[ref] Parameter - CVE-2025-14891: Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber) Stored Cross-Site Scripting via displayName Parameter - CVE-2025-5720: Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter - CVE-2024-10614: Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber) Import Cancellation - CVE-2024-3731: Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 'i' - CVE-2024-3869: Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber) Coupon Search - CVE-2024-3243: Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber) Arbitrary Email Sending 备注 Wordfence Intelligence: 提供免费的个人和商业 API 访问，用于查询漏洞数据库。 支持: 提供 24 小时支持，响应时间为 1 小时。 页脚信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式: wfi-support@wordfence.com 导航栏 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central 支持: Documentation, Learning Center, Free Support, Premium Support 新闻: Blog, In The News, Vulnerability Advisories 关于: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 其他 隐私政策: Privacy Policy and Notice at Collection 服务条款: Terms of Service 不卖或共享我的个人信息: Do Not Sell or Share My Personal Information 社交媒体 Facebook: 链接 Twitter: 链接 LinkedIn: 链接 Instagram: 链接 订阅 订阅新闻: Sign up for news and updates from our panel of experienced security professionals. 免责声明 免责声明: This record contains material that is subject to copyright. 联系方式 联系邮箱: wfi-support@wordfence.com 其他链接 Wordfence Intelligence: 链接 Wordfence Free: 链接 Wordfence Premium: 链接 Wordfence Care: 链接 Wordfence Response: 链接 Wordfence CLI: 链接 Wordfence Intelligence: 链接 Wordfence Central: 链接 其他信息 Wordfence Intelligence: 提供免费的个人和商业 API 访问，用于查询漏洞数据库。 支持: 提供 24 小时支持，响应时间为 1 小时。 页脚信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式: wfi-support@wordfence.com 导航栏 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central 支持: Documentation, Learning Center, Free Support, Premium Support 新闻: Blog, In The News, Vulnerability Advisories 关于: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 其他 隐私政策: Privacy Policy and Notice at Collection 服务条款: Terms of Service 不卖或共享我的个人信息: Do Not Sell or Share My Personal Information 社交媒体 Facebook: 链接 Twitter: 链接 LinkedIn: 链接 Instagram: 链接 订阅 订阅新闻: Sign up for news and updates from our panel of experienced security professionals. 免责声明 免责声明: This record contains material that is subject to copyright. 联系方式 联系邮箱: wfi-support@wordfence.com 其他链接 Wordfence Intelligence: 链接 Wordfence Free: 链接 Wordfence Premium: 链接 Wordfence Care: 链接 Wordfence Response: 链接 Wordfence CLI: 链接 Wordfence Intelligence: 链接 Wordfence Central: 链接 其他信息 Wordfence Intelligence: 提供免费的个人和商业 API 访问，用于查询漏洞数据库。 支持: 提供 24 小时支持，响应时间为 1 小时。 页脚信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式: wfi-support@wordfence.com 导航栏 产品: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central 支持: Documentation, Learning Center, Free Support, Premium Support 新闻: Blog, In The News, Vulnerability Advisories 关于: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form 其他 隐私政策: Privacy Policy and Notice at Collection 服务条款: Terms of Service 不卖或共享我的个人信息: Do Not Sell or Share My Personal Information 社交媒体 Facebook: 链接 Twitter: 链接 LinkedIn: 链接 Instagram: 链接 订阅 订阅新闻: Sign up for news and updates from our panel of experienced security professionals. 免责声明 免责声明: This record contains material that is subject to copyright. 联系方式 联系邮箱: wfi-support@wordfence.com 其他链接 Wordfence Intelligence: 链接 Wordfence Free: 链接 Wordfence Premium: 链接 Wordfence Care: 链接 Wordfence Response:

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Customer Reviews for WooCommerce 存储型XSS漏洞(CVE-2026-13771)公告

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Customer Reviews for WooCommerce 存储型XSS漏洞(CVE-2026-13771)公告

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！