An unauthenticated Stored Cross-Site Scripting vulnerability in the Customer Reviews for WooCommerce plugin allows remote attackers to execute arbitrary scripts in the context of a user session.

The vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw caused by insufficient sanitization and escaping of content within the review submission endpoint. This allows unauthenticated attackers to inject malicious scripts that execute when a victim views the compromised review.

Successful exploitation allows an attacker to hijack administrator or user sessions, potentially leading to unauthorized data access, account takeover, or the distribution of malicious content to site visitors. With a CVSS score of 8.8 (High), this vulnerability poses a significant risk to site integrity and user trust, as it can be leveraged to compromise the administrative interface of the WordPress environment.

Immediate Action: Update the Customer Reviews for WooCommerce plugin to version 5.118.0 or later immediately to apply the necessary sanitization patches.

Proactive Monitoring: Review web server access logs for anomalous POST requests to review submission endpoints and monitor site traffic for unusual script execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in input fields until the plugin can be successfully patched.

Public Exploit Available: Unknown.

Given the potential for full session compromise and the high CVSS severity rating, administrators should prioritize updating this plugin immediately. Failure to remediate this flaw exposes the WordPress instance to persistent malicious script injection, which could be used to facilitate wider attacks against the site and its authenticated users.