CVE-2026-100161

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. By exploiting the wcpr image upload id parameter, an attacker can inject arbitrary web scripts into comment meta, which is not processed by wp kses (a WordPress function used to sanitize HTML). The attack is facilitated by the publicly available wcpr image upload nonce on product review forms, as the system fails to perform capability, authentication, or attachment ownership checks. The injected scripts execute when a user views the affected review on the frontend.

Recommendations Update to a version later than 1.2.30.