WooCommerce Customer Reviews <= 5.113.0 Authenticated Stored XSS (CVE-2026-13771)

Vulnerability Overview Vulnerability Name: Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute CVE ID: CVE-2026-13771 CVSS Score: 6.4 (Medium) Public Release Date: July 8, 2026 Last Updated: July 9, 2026 Researchers: Athiwat Tiprasan (Jitada), Ithidej Araman (Boing777) Impact Scope Software Type: Plugin Software Identifier: customer-reviews-woocommerce Affected Versions: <= 5.113.0 Fixed Version: 5.114.0 Remediation Remediation Measure: Update to version 5.114.0 or later Vulnerability Description This vulnerability allows authenticated users (with Contributor role or higher) to inject malicious scripts via the 'color' shortcode attribute, resulting in a Stored Cross-Site Scripting (XSS) attack. An attacker can exploit this vulnerability to execute arbitrary JavaScript code on the page, thereby stealing user data or performing other malicious actions. Reference Links plugins.trac.wordpress.org Additional Information Recently Discovered Vulnerabilities: - CVE-2026-56043: Customer Reviews for WooCommerce <= 5.110.1 - Unauthenticated Stored Cross-Site Scripting - CVE-2026-3355: Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'search' - CVE-2026-4664: Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authorization Bypass to Arbitrary Review Submission via key Parameter - CVE-2026-1316: Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[ref] Parameter - CVE-2025-14891: Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber) Stored Cross-Site Scripting via displayName Parameter - CVE-2025-5720: Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter - CVE-2024-10614: Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber) Import Cancellation - CVE-2024-3731: Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 'i' - CVE-2024-3869: Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber) Coupon Search - CVE-2024-3243: Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber) Arbitrary Email Sending Notes Wordfence Intelligence: Provides free personal and commercial API access for querying the vulnerability database. Support: Provides 24-hour support with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact: wfi-support@wordfence.com Navigation Bar Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Other Privacy Policy: Privacy Policy and Notice at Collection Terms of Service: Terms of Service Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Subscription Subscribe for News: Sign up for news and updates from our panel of experienced security professionals. Disclaimer Disclaimer: This record contains material that is subject to copyright. Contact Information Contact Email: wfi-support@wordfence.com Other Links Wordfence Intelligence: Link Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Additional Information Wordfence Intelligence: Provides free personal and commercial API access for querying the vulnerability database. Support: Provides 24-hour support with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Contact: wfi-support@wordfence.com Navigation Bar Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Other Privacy Policy: Privacy Policy and Notice at Collection Terms of Service: Terms of Service Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Subscription Subscribe for News: Sign up for news and updates from our panel of experienced security professionals. Disclaimer Disclaimer: This record contains material that is subject to copyright. Contact Information Contact Email: wfi-support@wordfence.com Other Links Wordfence Intelligence: Link Wordfence Free: Link Wordfence Premium: Link Wordfence Care:

Goal Reached Thanks to every supporter — we hit 100%!

WooCommerce Customer Reviews <= 5.113.0 Authenticated Stored XSS (CVE-2026-13771)

More from this source