CVE-2025-14891

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14891", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-18T15:35:27.343Z", "datePublished": "2026-01-07T03:21:03.139Z", "dateUpdated": "2026-04-08T17:05:20.992Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:20.992Z"}, "affected": [{"vendor": "ivole", "product": "Customer Reviews for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.93.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While it is possible to invoke the AJAX action without authentication, the attacker would need to know a valid form ID, which requires them to place an order. This vulnerability can be exploited by unauthenticated attackers if guest checkout is enabled. However, the form ID still needs to be obtained through placing an order."}], "title": "Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-18T15:51:09.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T14:32:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:53:21.749685Z", "id": "CVE-2025-14891", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:55.739Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14891", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:53:21.749685Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:53:24.484Z"}}], "cna": {"title": "Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ivole", "product": "Customer Reviews for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.93.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-18T15:51:09.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T14:32:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19"}, {"url": "https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce"}], "descriptions": [{"lang": "en", "value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While it is possible to invoke the AJAX action without authentication, the attacker would need to know a valid form ID, which requires them to place an order. This vulnerability can be exploited by unauthenticated attackers if guest checkout is enabled. However, the form ID still needs to be obtained through placing an order."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:20.992Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14891", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:20.992Z", "dateReserved": "2025-12-18T15:35:27.343Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T03:21:03.139Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Customer Reviews for WooCommerce", "vendor": "ivole", "versions": [{"lessThanOrEqual": "5.93.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with customer-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While it is possible to invoke the AJAX action without authentication, the attacker would need to know a valid form ID, which requires them to place an order. This vulnerability can be exploited by unauthenticated attackers if guest checkout is enabled. However, the form ID still needs to be obtained through placing an order."}, {"lang": "es", "value": "El plugin Customer Reviews for WooCommerce para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'displayName' en todas las versiones hasta la 5.93.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de cliente y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Si bien es posible invocar la acci\u00f3n AJAX sin autenticaci\u00f3n, el atacante necesitar\u00eda conocer un ID de formulario v\u00e1lido, lo que les exige realizar un pedido. Esta vulnerabilidad puede ser explotada por atacantes no autenticados si el pago como invitado est\u00e1 habilitado. Sin embargo, el ID de formulario a\u00fan debe obtenerse a trav\u00e9s de la realizaci\u00f3n de un pedido."}], "id": "CVE-2025-14891", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14891", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:53:21.749685Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:57.790", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/includes/reminders/class-cr-local-forms-ajax.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/trunk/templates/form-customer.php#L19"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3424980/customer-reviews-woocommerce"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88e4eec2-2861-4d1d-97eb-67887f59c745?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:06:23.169826+00:00", "value": {"mitigation_remediation": ["Update the Customer Reviews for WooCommerce plugin to the latest available version, which includes proper sanitization and escaping for the displayName field.", "Immediately disable the plugin on environments where review functionality is not required until an update can be applied, or restrict review posting to a role higher than subscriber if quick deployment is not possible.", "If an immediate update is not feasible, enforce client\u2011side filtering of the displayName field to remove script tags, and validate the input on the server side to reject any characters that could lead to malicious execution.", "Turn off guest checkout if the site allows it, to remove the non\u2011authenticated exploitation pathway flagged in the description.", "Deploy a web application firewall rule that blocks common XSS payloads targeting the displayName endpoint, and monitor requests for anomalous script injection attempts."], "summary": {"action": "Assess Impact", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all Customer Reviews for WooCommerce releases up to and including version 5.93.1. Sites that use this WordPress plugin\u2014any WordPress installation where the plugin is active\u2014are in scope. No other vendors or products are listed.", "description_and_impact": "The Customer Reviews for WooCommerce plugin allows attackers with at least subscriber\u2011level access, or occasionally unauthenticated users when guest checkout is turned on, to inject arbitrary JavaScript using the displayName parameter. The developer fails to sanitize this input or escape it when rendering, so the payload is stored and executed every time any user loads the affected form page. The flaw is a classic Stored XSS (CWE\u201179) and can lead to session hijacking, defacement, or phishing of other site visitors.", "risk_and_exploitability": "The listed CVSS score of 6.4 indicates moderate severity, and an EPSS figure of less than 1\u202f% suggests low observed exploit activity so far. Because the flaw requires form data to be stored, an attacker must place a form submission to acquire a valid form ID; this limits the immediate reach but still poses a risk, especially when guest checkout facilitates order creation by unauthenticated users. The vulnerability is not in CISA KEV, and no official fix is referenced in the provided CNA data, but the change set link implies an upstream fix exists in a newer release. Attackers can exploit this via the AJAX endpoint or by direct form submission, as inferred from the code references."}}}}, "created": "2026-01-07T10:08:09.669555+00:00", "updated": "2026-04-22T00:15:03.768613+00:00", "vendors": ["ivole", "ivole$PRODUCT$customer_reviews_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}