Known vulnerabilities in Customer Reviews for WooCommerce

Customer Reviews for WooCommerce plugin helps you get more sales with social proof. Set up automated review reminders and increase conversion rate.

29Reported vulnerabilities

9.1Highest CVSS score

5.116.0Latest version

80,000+Active installs

What to do now

Update Customer Reviews for WooCommerce to 5.123.0 or later. 29 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 3, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-0080	High 8.8	1.1%	Before 5.16.0	`5.16.0`	February 13, 2023
CVE-2023-0079	Medium 5.4	0.5%	Before 5.17.0	`5.17.0`	January 16, 2024
CVE-2026-89055	Critical 9.1	0.4%	0 to 5.120.0 (inclusive)	`5.121.0`	September 25, 2026
CVE-2023-6979	High 8.8	1.1%	5.38.9 and earlier	`5.38.10`	January 11, 2024
CVE-2022-38134	High 8.8	1.0%	5.3.5 and earlier	`5.3.6`	September 23, 2022
CVE-2022-38470	High 8.8	0.4%	5.3.5 and earlier	`5.3.6`	September 23, 2022
CVE-2022-40194	High 7.5	0.9%	5.3.5 and earlier	`5.3.6`	September 23, 2022
CVE-2026-76585	High 7.2	0.5%	Before 5.118.0	`5.118.0`	August 31, 2026
CVE-2026-6176	High 7.2	0.4%	0 to 5.106.0 (inclusive)	`5.107.0`	August 28, 2026
CVE-2026-56043	High 7.2	0.3%	5.110.1 and earlier	`5.111.0`	June 24, 2026
CVE-2026-1316	High 7.2	0.3%	0 to 5.97.0 (inclusive)	`5.98.0`	February 12, 2026
CVE-2026-97663	High 7.2	0.2%	0 to 5.122.0 (inclusive)	`5.123.0`	October 2, 2026
CVE-2026-13771	Medium 6.4	0.4%	0 to 5.113.0 (inclusive)	`5.114.0`	July 9, 2026
CVE-2025-14891	Medium 6.4	0.3%	0 to 5.93.1 (inclusive)	`5.94.0`	January 7, 2026
CVE-2025-5720	Medium 6.4	0.3%	0 to 5.80.2 (inclusive)	`5.81.0`	July 31, 2025
CVE-2026-3355	Medium 6.1	0.3%	0 to 5.101.0 (inclusive)	`5.102.0`	April 16, 2026
CVE-2024-3731	Medium 6.1	0.4%	Before 5.48.0	`5.48.0`	April 19, 2024
CVE-2026-4664	Medium 5.3	0.6%	0 to 5.103.0 (inclusive)	`5.104.0`	April 10, 2026
CVE-2023-45101	Medium 5.4	0.4%	5.36.0 and earlier	`5.36.1`	October 6, 2023
CVE-2026-96823	Medium 5.3	0.3%	5.120.0 and earlier	`5.121.0`	September 24, 2026
CVE-2024-1044	Medium 5.3	0.4%	Before 5.39.0	`5.39.0`	February 29, 2024
CVE-2023-51692	Medium 5.3	0.3%	5.38.1 and earlier	`5.38.2`	December 27, 2023
CVE-2026-14941	Medium 4.3	0.2%	5.115.0 and earlier	`5.116.0`	August 6, 2026
CVE-2024-10614	Medium 4.3	0.3%	Before 5.61.1	`5.61.1`	November 16, 2024
CVE-2024-3869	Medium 4.3	0.5%	Before 5.47.0	`5.47.0`	April 16, 2024
CVE-2024-3243	Medium 4.3	0.4%	Before 5.47.0	`5.47.0`	April 16, 2024
WF-b243722e-6510-48bd-be26-95ccbe79fa57	Medium 4.3	—	Before 5.38.2	`5.38.2`	November 19, 2023
WF-c6e2710f-f51a-487d-a4bb-a19f614ff254	Medium 4.3	—	Before 5.38.2	`5.38.2`	November 19, 2023
WF-c5429fb1-7072-4a00-8fb3-48d4f876417f	Medium 4.3	—	Before 5.36.1	`5.36.1`	October 4, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.