CVE-2026-97663

validated

GHSA-x5w6-fhq8-hh7v ↗EUVD-2026-91237 ↗

check availablenot proven exploitable

cve.orgpublic pockev

ivole Customer Reviews for WooCommerce <= 5.122.0

ETK-2026-430, permanent identifier

cvss7.2cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

+1.0dTTV

37mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+24h37magent stopped

+6h

+12h

+18h

description

Customer Reviews for WooCommerce versions through 5.122.0 can retain unsafe review author-name content that is later rendered in pages. An unauthenticated attacker may cause browser-side script to run for people viewing an affected review page when the plugin's image-attachment feature is enabled.

mitigation

Disable the ivole_attach_image image-attachment feature until the plugin is updated to a vendor release that addresses the issue. Review and remove untrusted existing review content after updating.

check

available

exploit

automation

deterministic

auth required

EPSS

0.24%14th percentile

agent run time

37m

cve.org record, t = 0

2026-10-02 07:39Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-02 07:39Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-x5w6-fhq8-hh7v
2026-10-02 07:39Z
cve.org record for CVE-2026-97663
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-97663

this entry in the feed

GET /api/v1/feed/CVE-2026-97663

{
  "etk_id": "ETK-2026-430",
  "cve_id": "CVE-2026-97663",
  "display_id": "CVE-2026-97663",
  "ghsa_id": "GHSA-x5w6-fhq8-hh7v",
  "euvd_id": "EUVD-2026-91237",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Customer Reviews for WooCommerce",
  "summary": "Customer Reviews for WooCommerce versions through 5.122.0 can retain unsafe review author-name content that is later rendered in pages. An unauthenticated attacker may cause browser-side script to run for people viewing an affected review page when the plugin's image-attachment feature is enabled.",
  "mitigation": "Disable the `ivole_attach_image` image-attachment feature until the plugin is updated to a vendor release that addresses the issue. Review and remove untrusted existing review content after updating.",
  "vendor": "ivole",
  "product": "Customer Reviews for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 5.122.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Customer Reviews for WooCommerce",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1429,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 36.805220616666666,
  "t0_at": "2026-10-02T07:39:20.600000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-03T08:16:27.370779+00:00",
      "days": 1.0257728099421297,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T07:39:20.600000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-02T07:39:20.600000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T07:39:20.600000+00:00",
      "url": "https://github.com/advisories/GHSA-x5w6-fhq8-hh7v"
    }
  }
}

published 2026-10-03 07:39Z
last change 2026-10-21 11:38Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.