CVE-2026-11608

Name of the Vulnerable Software and Affected Versions WP Customer Reviews versions prior to 3.7.9

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the wpcr3 fname parameter, enabling the injection of arbitrary web scripts into pages that execute when a user is tricked into clicking a malicious link.

Recommendations Update to a version newer than 3.7.8. Avoid using the wpcr3 fname parameter until the update is applied.