CVE-2026-100515
HighCVSS 7.1Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
Risk Assessment
An attacker can inject a malicious script that executes in the user's browser, potentially leading to session theft, account takeover, or displaying fake content.
Recommendation
Upgrade the plugin to the latest available version that includes a fix, and apply input and output filtering.
Other vulnerabilities in Photo Reviews for WooCommerce
See all- CVE-2026-101923High
The Photo Reviews for WooCommerce plugin for WordPress, up to version 1.2.30, is vulnerable to arbitrary content deletion. The plugin stores attacker-controlled post IDs in review comment meta without verifying ownership, and the deletion handler unconditionally deletes all stored IDs. This allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media when an administrator deletes the review or when WordPress's cron empties the comment trash after 30 days.
- CVE-2026-100517High
The Photo Reviews for WooCommerce plugin in versions up to 1.2.30 contains an Insecure Direct Object References (IDOR) vulnerability exploitable by an unauthenticated attacker. Missing access controls allow access to objects the user should not be authorized to access.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS