Customer Reviews For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:customer_reviews_for_woocommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Customer Reviews For Woocommerce (135235fb-3c6e-5236-9bdf-43ea5d5c4482) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14941 |
vulnerable | 2026-09-16 04:33:11.527732 |
Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Published: 2026-08-10T06:00:15.437Z
Updated: 2026-08-11T20:37:06.723Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12684 |
vulnerable | 2026-07-29 00:23:32.504706 |
Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Published: 2026-07-16T06:00:04.102Z
Updated: 2026-07-16T17:57:31.091Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0080 |
vulnerable | 2026-06-08 05:52:04.240281 |
Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Published: 2023-02-13T14:32:22.189Z
Updated: 2025-03-21T15:24:17.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0079 |
vulnerable | 2026-06-08 05:52:04.238677 |
Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS
The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Published: 2024-01-16T15:54:58.622Z
Updated: 2025-06-02T15:10:16.362Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.