What’s Vulnerable › Products

ivole Customer Reviews for WooCommerce vulnerabilities

27 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your ivole Customer Reviews for WooCommerce version is affected

Latest ivole Customer Reviews for WooCommerce vulnerabilities

• CVE-2026-97663 — Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2)
• CVE-2026-96823 — WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
• CVE-2026-89055 — Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter (CVSS 9.1)
• CVE-2026-76585 — Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter (CVSS 8.8)
• CVE-2026-6176 — Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form (CVSS 7.2)
• CVE-2026-14941 — Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions (CVSS 5.4)
• CVE-2026-12684 — Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media (CVSS 6.5)
• CVE-2026-13771 — Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4)
• CVE-2026-56043 — WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-3355 — Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch' (CVSS 6.1)
• CVE-2026-4664 — Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter (CVSS 5.3)
• CVE-2026-1316 — Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter (CVSS 7.2)
• CVE-2025-14891 — Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter (CVSS 6.4)
• CVE-2025-5720 — Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter (CVSS 6.4)
• CVE-2023-45101 — WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2024-10614 — Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation (CVSS 4.3)
• CVE-2024-3731 — Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's' (CVSS 6.1)
• CVE-2024-3869 — Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search (CVSS 4.3)
• CVE-2024-3243 — Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (CVSS 4.3)
• CVE-2024-1044 — Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review (CVSS 5.3)
• CVE-2023-51692 — WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control (CVSS 4.3)
• CVE-2023-0079 — Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS (CVSS 5.4)
• CVE-2023-6979 — Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8)
• CVE-2023-0080 — Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI (CVSS 8.8)
• CVE-2022-40194 — WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Sensitive Information Disclosure vulnerability (CVSS 7.5)