Advisories · Technology
ivole Customer Reviews for WooCommerce.
Every CVE that names ivole Customer Reviews for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 7.2 High
Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch'
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Customer Reviews for WooCommerce <= 5.103.0 - Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter
- ivole Customer Reviews for WooCommerce
- Authentication bypass
- CVSS 7.2 High
Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 6.1 Medium
Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 4.3 Medium
Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 5.3 Medium
Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review
- ivole Customer Reviews for WooCommerce
- Broken access control
- CVSS 8.8 High
Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload
- ivole Customer Reviews for WooCommerce
- Unrestricted file upload