The ivole Customer Reviews for WooCommerce plugin is vulnerable to stored cross-site scripting, allowing unauthenticated attackers to inject malicious scripts into web pages.

This is a stored cross-site scripting (CWE-79) vulnerability occurring in the media[].href parameter. Unauthenticated attackers can trigger this flaw if the "Enable for Guests" setting is active, leading to arbitrary script execution in the context of a victim's browser.

Successful exploitation allows an attacker to execute malicious JavaScript within the browsers of site visitors or administrators. This can lead to session hijacking, unauthorized actions performed on behalf of users, or the defacement of the website, resulting in significant reputational damage and potential loss of user trust. The CVSS score of 7.2 justifies a high severity rating due to the ease of remote exploitation and the potential for impact on site integrity.

Immediate Action: Update the Customer Reviews for WooCommerce plugin to version 5.97.1 or higher immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web access logs for suspicious requests targeting the media parameter and monitor for unusual administrative actions or unauthorized script modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious cross-site scripting payloads if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to site security, particularly for installations that allow guest reviews. Administrators should verify their plugin version immediately and apply the vendor-provided update to prevent potential script injection attacks. Timely patching is essential to maintain the integrity of the web environment and protect site visitors from malicious redirection or data theft.