Woocommerce Photo Reviews Vulnerabilities

The The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unaut...

CVSS:

6.5

Affected:

up to 1.4.4

Fix:

No patched version reported

Disclosed:

Aug 27, 2025

CVE-2026-28132 on NVD →

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 1.3.13

Fix:

No patched version reported

Disclosed:

Jun 3, 2025

CVE-2025-47570 on NVD →

The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2. This is due to the plugin not properly validating what user transient is being used in the login() function and not properly verifying the user's identity. This makes it poss...

CVSS:

9.8

Affected:

up to 1.3.13.2

Fixed in:

1.3.14

Disclosed:

Sep 10, 2024

CVE-2024-8277 on NVD →