CVE-2026-97663

Executive Summary

CVE-2026-97663 is a stored cross-site scripting (XSS) vulnerability in the Customer Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 5.122.0. The flaw allows unauthenticated attackers to inject arbitrary JavaScript via the review author name field when the plugin's image attachment feature (ivole_attach_image) is enabled, with payloads executing in the browsers of any user viewing the affected review page. Successful exploitation can lead to session hijacking, credential theft, and malicious redirects within the context of the WordPress site.

Technical Analysis

The vulnerability resides in the comment author name handling within the Customer Reviews for WooCommerce plugin. The plugin fails to adequately sanitize user-supplied input in the author name field and does not escape this value on output when rendering reviews. Because WordPress reviews are publicly submittable through the frontend, an unauthenticated attacker can supply an entity-encoded payload as the author name that bypasses initial input filtering and is subsequently rendered without output escaping on the review display page.

The exploitation path is gated by a specific configuration requirement: the plugin's image attachment feature (ivole_attach_image) must be enabled. Under this condition, the plugin exposes the wp_ajax_nopriv_cr_upload_local_images_frontend AJAX action—a WordPress nopriv endpoint accessible without authentication. This endpoint allows an unauthenticated user to both submit a review carrying a malicious, entity-encoded author name and upload an attached image in the same flow. The combination of unauthenticated review submission, the entity-encoding evasion of sanitization, and the absence of output escaping when the author name is displayed constitutes the full mechanism of this stored XSS.

From a code-level perspective (derived strictly from the description), the defect is a classic CWE-79 arising from two compounding failures: insufficient input sanitization (entity encoding survives any partial filtering) and insufficient output escaping (the stored value is emitted into HTML without contextual encoding). The S:C scope-change rating in the CVSS vector reflects that the injected script executes in the security context of the victim's browsing session and can impact resources beyond the vulnerable component—for example, WordPress administrative functions if an administrator views the review.

No public proof-of-concept, Nuclei template, or exploit code is available at the time of writing. The attack chain is inferred from the vulnerability class and the endpoint details provided in the description.

Exploitation Scenarios

1. Reconnaissance/target identification. An attacker enumerates WordPress sites running the Customer Reviews for WooCommerce plugin, ideally at versions <= 5.122.0. Publicly accessible review pages and the presence of review UI elements or the ivole_attach_image feature indicate a candidate target. Standard web fingerprinting for WordPress plugins can identify exposed installations.

2. Triggering the flaw class. The attacker confirms the image attachment feature is enabled, since exploitation depends on ivole_attach_image. This feature exposes the publicly accessible wp_ajax_nopriv_cr_upload_local_images_frontend endpoint, which permits unauthenticated review submission combined with image upload.

3. Payload/execution at the vulnerability-class level. The attacker submits a review whose author name contains an entity-encoded JavaScript payload, then uploads an attached image via the same unauthenticated frontend flow. Because input sanitization is insufficient and output escaping is absent, the encoded payload is stored and later decoded/rendered as executable script when any user loads the page displaying the review. No specific code pattern beyond this mechanism can be asserted, as no PoC is available.

4. Post-exploitation impact. When a victim—including an authenticated administrator browsing reviews—views the injected page, the arbitrary script executes in their browser context. Depending on victim privileges, this can enable session theft, credential harvesting, forced actions through the WordPress admin interface, malicious redirects, or drive-by content injection. The S:C scope change in the CVSS vector indicates the impact can extend beyond the plugin to the broader WordPress application.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The CVSS 3.1 base score is 7.2 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. Network reachability (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction required (UI:N) make this trivially exploitable at scale by unauthenticated attackers. The Scope Change (S:C) reflects that exploitation can affect components beyond the vulnerable plugin—most critically, the wider WordPress application and any administrative sessions that view injected content. Confidentiality and Integrity impacts are Low, with no Availability impact, but the true blast radius is contextual: a single stored payload can execute for every visitor of the affected page, multiplying the impact across an entire user base.

Business impact includes potential compromise of user and administrator sessions, defacement or content manipulation of storefront review pages, phishing delivered from a trusted domain, and downstream compromise of e-commerce accounts. Because WooCommerce is a high-value e-commerce platform, injected scripts could target checkout flows or customer data. Affected systems are WordPress sites running the Customer Reviews for WooCommerce plugin at version <= 5.122.0 with the image attachment feature enabled.

Detection Guidance

Sigma Rule

title: Unauthenticated Review Submission with Script Payload in Author Name
id: 9f3a7c2e-2026-4b21-9e77-cve202697663
status: experimental
description: Detects unauthenticated review submissions containing encoded script payloads, consistent with CVE-2026-97663
author: valtersit.com
date: 2026-01-01
logsource:
  product: webserver
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'action=cr_upload_local_images_frontend'
      - 'wp_ajax_nopriv_cr_upload_local_images_frontend'
  selection_payload:
    cs-uri-query|contains:
      - '%26lt%3Bscript'
      - '%3Cscript'
      - 'onerror'
      - 'onload'
      - 'javascript:'
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate reviews containing encoded HTML in benign contexts
level: high

YARA Rule

rule CVE_2026_97663_WooCommerce_Stored_XSS
{
    meta:
        description = "Detects encoded script payloads targeting Customer Reviews for WooCommerce author name (CVE-2026-97663)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-97663"
        severity = "high"
    strings:
        $endpoint = "cr_upload_local_images_frontend"
        $enc1 = "<script" nocase
        $enc2 = "%3Cscript" nocase
        $enc3 = "<script" nocase
        $evt1 = "onerror=" nocase
        $evt2 = "onload=" nocase
        $evt3 = "onmouseover=" nocase
    condition:
        $endpoint or (2 of ($enc*) or 1 of ($evt*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97663 Customer Reviews for WooCommerce Stored XSS Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"wp_ajax_nopriv_cr_upload_local_images_frontend"; http.uri; content:"action=cr_upload_local_images_frontend"; content:"<script"; nocase; content:"onerror"; nocase; sid:2026976630; rev:1; reference:cve,CVE-2026-97663; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      (http.request.body.text contains "cr_upload_local_images_frontend" or
       url.query contains "cr_upload_local_images_frontend") ]
  [ network where http.request.body.text contains "<script" or
      http.request.body.text contains "%3Cscript" or
      http.request.body.text contains "onerror=" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=linux_apache
| search (uri_path="*/wp-admin/admin-ajax.php" OR uri_query="*cr_upload_local_images_frontend*")
| eval sus = if(match(uri_query, "(?i)(%26lt%3Bscript|%3Cscript|onerror=|onload=|javascript:)"), 1, 0)
| where sus=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_query, http_user_agent
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-97663,">
  <rule id="202697663" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>admin-ajax\.php.*cr_upload_local_images_frontend.*(?:%26lt%3Bscript|%3Cscript|onerror=|onload=)</regex>
    <description>CVE-2026-97663: Possible unauthenticated stored XSS attempt via Customer Reviews for WooCommerce frontend image upload endpoint</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source claims patch; not independently confirmed).

1. Immediate mitigations.

   • Disable the plugin's image attachment feature (ivole_attach_image) if not operationally required, removing the wp_ajax_nopriv_cr_upload_local_images_frontend unauthenticated path used for exploitation.
   • Deploy a Web Application Firewall (WAF) rule to block encoded script patterns (<script, %3Cscript, onerror=, onload=) in review submission parameters.
   • Enforce Content Security Policy (CSP) headers to limit inline script execution as a defense-in-depth measure.
   • Monitor and moderate user-submitted reviews for anomalous author names containing encoded markup.

2. Patch/upgrade steps.

   • NVD is the single source claiming a patch exists; no specific patched version has been independently confirmed. Verify the latest available plugin release from the vendor and apply it, ensuring the installed version exceeds 5.122.0.
   • Back up the site and database before upgrading. After upgrade, re-verify that author name input sanitization and output escaping are functioning by testing review display.

3. Long-term hardening.

   • Apply contextual output escaping and strict input validation to all user-controllable review fields, including author name.
   • Restrict nopriv AJAX actions to only those strictly necessary, and require nonce or rate-limit controls on frontend submission endpoints.
   • Maintain a WordPress plugin inventory with version tracking and subscribe to vendor security advisories.
   • Run periodic authenticated and unauthenticated web application security scans focused on stored XSS in user-generated content features.

References

• NVD entry for CVE-2026-97663: https://nvd.nist.gov/vuln/detail/CVE-2026-97663
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — JavaScript/JScript: https://attack.mitre.org/techniques/T1059/007/
• WordPress Plugin Security guidance: https://developer.wordpress.org/plugins/security/
• Customer Reviews for WooCommerce plugin page (vendor listing): https://wordpress.org/plugins/customer-reviews-woocommerce/

No public PoC, exploit code, or Nuclei template is available. No CISA KEV listing or known in-the-wild campaign has been recorded for this CVE at the time of writing.