Advisories · Technology

VillaTheme Photo Reviews for WooCommerce.

Every CVE that names VillaTheme Photo Reviews for WooCommerce among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-111404 CVE record

CVSS 3.7 Low

WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
- VillaTheme Photo Reviews for WooCommerce
- Race condition
Not analysed yet 26 Oct 2026
CVE-2026-100161 CVE record

CVSS 7.2 High

Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
- villatheme Photo Reviews for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-100515 CVE record

CVSS 7.1 High

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability
- VillaTheme Photo Reviews for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 5 Oct 2026
CVE-2026-101923 CVE record

CVSS 8.1 High

Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
- villatheme Photo Reviews for WooCommerce
- Broken access control
Not analysed yet 3 Oct 2026
CVE-2026-100517 CVE record

CVSS 7.5 High

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
- VillaTheme Photo Reviews for WooCommerce
- Broken access control
Not analysed yet 1 Oct 2026