CVE-2026-97663

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.123.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This occurs when the image attachment feature ivole attach image is enabled, allowing attackers to submit a review with an entity-encoded malicious author name and upload an image via the wp ajax nopriv cr upload local images frontend endpoint. The injected scripts execute whenever a user accesses the affected page.

Recommendations Update to a version newer than 5.122.0. As a temporary mitigation, disable the ivole attach image image attachment feature.