CVE-2026-97663Published
Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-97663 · Microsoft / collected KEV context
cve-program · CVE-2026-97663
- https://www.wordfence.com/threat-intel/vulnerabilities/id/01573bd1-7ac0-4a12-9bf1-097db4d5ec1e?source=cve
- https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.122.0/includes/reviews/class-cr-reviews-list-table.php#L1051
- https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.122.0/js/all-reviews.js#L18
- https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.122.0/includes/reviews/class-cr-reviews.php#L238
- https://plugins.trac.wordpress.org/browser/customer-reviews-woocommerce/tags/5.122.0/includes/reviews/class-cr-reviews.php#L63
- https://plugins.trac.wordpress.org/changeset/3716157/
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.