PLUGIN SECURITY
Is Customer Reviews for WooCommerce safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Customer Reviews for WooCommerce WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
customer-reviews-woocommerce
Maintenance status
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
29 known CVEs on file for Customer Reviews for WooCommerce.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-121518 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.128.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.128.0 | 5.128.0 | 2026-11-04 | — |
| CVE-2026-120553 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.127.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.127.0 | 5.127.0 | 2026-10-01 | — |
| CVE-2026-97663 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.123.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 5.123.0 | 5.123.0 | 2026-09-24 | — |
| CVE-2026-96823 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.121.0 | Missing Authorization | High 7.5 | < 5.121.0 | 5.121.0 | 2026-09-24 | — |
| CVE-2026-89055 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.121.0 | Missing Authorization | Critical 9.1 | < 5.121.0 | 5.121.0 | 2026-08-31 | — |
| CVE-2026-76585 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.118.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 5.118.0 | 5.118.0 | 2026-08-27 | — |
| CVE-2026-14941 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.116.0 | Missing Authorization | Unknown | < 5.116.0 | 5.116.0 | 2026-08-06 | — |
| CVE-2026-6176 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.107.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 5.107.0 | 5.107.0 | 2026-08-06 | — |
+ 33 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-12684 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.113.0 | Unrestricted Upload of File with Dangerous Type | Unknown | < 5.113.0 | 5.113.0 | 2026-07-16 | — |
| CVE-2026-13771 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.114.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.114.0 | 5.114.0 | 2026-07-08 | — |
| CVE-2026-56043 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.111.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.111.0 | 5.111.0 | 2026-06-24 | — |
| CVE-2026-3355 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.102.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.102.0 | 5.102.0 | 2026-04-15 | — |
| CVE-2025-14891 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.94.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.94.0 | 5.94.0 | 2026-01-06 | — |
| CVE-2024-10614 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.62.0 | Missing Authorization | Medium 4.3 | < 5.62.0 | 5.62.0 | 2024-11-15 | — |
| CVE-2024-3731 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.48.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.48.0 | 5.48.0 | 2024-04-18 | — |
| CVE-2024-3869 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.47.0 | Missing Authorization | Medium 4.3 | < 5.47.0 | 5.47.0 | 2024-04-15 | — |
| CVE-2024-3243 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.47.0 | Missing Authorization | Medium 4.3 | < 5.47.0 | 5.47.0 | 2024-04-15 | — |
| CVE-2024-1044 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.39.0 | Improper Access Control | Medium 5.3 | < 5.39.0 | 5.39.0 | 2024-02-06 | — |
| CVE-2023-6979 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.10 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 5.38.10 | 5.38.10 | 2024-01-09 | — |
| CVE-2023-51692 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.2 | Missing Authorization | Medium 4.3 | < 5.38.2 | 5.38.2 | 2023-12-27 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.2 | — | Unknown | < 5.38.2 | 5.38.2 | 2023-11-19 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.2 | — | Unknown | < 5.38.2 | 5.38.2 | 2023-11-19 | — |
| CVE-2023-45101 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.36.1 | Missing Authorization | Medium 4.3 | < 5.36.1 | 5.36.1 | 2023-10-06 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.36.1 | — | Unknown | < 5.36.1 | 5.36.1 | 2023-10-04 | — |
| CVE-2023-0079 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.17.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 5.17.0 | 5.17.0 | 2023-01-24 | — |
| CVE-2023-0080 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.16.0 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 8.8 | < 5.16.0 | 5.16.0 | 2023-01-23 | — |
| CVE-2022-40194 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.3.6 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.3.6 | 5.3.6 | 2022-09-22 | — |
| CVE-2022-38470 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.3.6 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 5.3.6 | 5.3.6 | 2022-09-22 | — |
| CVE-2022-38134 | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.3.6 | — | Medium 4.3 | < 5.3.6 | 5.3.6 | 2022-09-22 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.81.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 5.81.0 | 5.81.0 | 0000-00-00 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.104.0 | — | Unknown | < 5.104.0 | 5.104.0 | 0000-00-00 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.98.0 | — | Unknown | < 5.98.0 | 5.98.0 | 0000-00-00 | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.36.1 | — | Unknown | < 5.36.1 | 5.36.1 | — | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.2 | — | Unknown | < 5.38.2 | 5.38.2 | — | — |
| — | Customer Reviews for WooCommerce [customer-reviews-woocommerce] < 5.38.2 | — | Unknown | < 5.38.2 | 5.38.2 | — | — |
| — | Customer Reviews for WooCommerce < 5.36.1 - Missing Authorization | — | Unknown | < 5.36.1 | 5.36.1 | — | — |
| — | Customer Reviews for WooCommerce < 5.38.2 - Cross-Site Request Forgery via manual review reminders | — | Unknown | < 5.38.2 | 5.38.2 | — | — |
| — | Customer Reviews for WooCommerce < 5.38.2 - Missing Authorization via manual review reminders | — | Unknown | < 5.38.2 | 5.38.2 | — | — |
| CVE-2025-5720 | Customer Reviews for WooCommerce < 5.81.0 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter | — | Unknown | < 5.81.0 | 5.81.0 | — | — |
| CVE-2026-1316 | Customer Reviews for WooCommerce < 5.98.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter | — | Unknown | < 5.98.0 | 5.98.0 | — | — |
| CVE-2026-4664 | Customer Reviews for WooCommerce < 5.104.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter | — | Unknown | < 5.104.0 | 5.104.0 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.