Vulnerabilities ›

CVE-2026-28132

Medium

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects W

CWE-80 — Weakness Type

                    Published: Feb 26, 2026                      ·  Modified: Mar 5, 2026                      ·  Source: NVD                

CVSS v3

5.3

🔗 NVD Official

📄 Description (English)

🤖 AI Executive Summary

CVE-2026-28132 is a Cross-Site Scripting (XSS) vulnerability in WooCommerce Photo Reviews plugin versions up to 1.4.4 that allows attackers to inject malicious scripts through improper HTML tag neutralization. This vulnerability could enable unauthorized code execution and compromise user sessions on affected e-commerce platforms.

📄 Description (Arabic)

تؤثر هذه الثغرة على إضافة WooCommerce Photo Reviews من خلال عدم معالجة علامات HTML المتعلقة بالبرامج النصية بشكل صحيح، مما يسمح بحقن أكواد ضارة. يمكن للمهاجمين استغلال هذه الثغرة لسرقة بيانات العملاء أو الوصول غير المصرح به إلى حسابات المستخدمين.

🤖 ملخص تنفيذي (AI)

This XSS vulnerability in WooCommerce Photo Reviews affects Saudi e-commerce businesses using this plugin, potentially allowing attackers to inject malicious code and steal customer data or session tokens. Organizations running vulnerable versions should immediately update to patch this security flaw.

🤖 AI Intelligence Analysis Analyzed: May 30, 2026 03:22

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

banking telecom government healthcare

🎯 MITRE ATT&CK Techniques

T1190 T1059

⚖️ Saudi Risk Score (AI)

5.0

/ 10.0

🔧 Remediation Steps (English)

Update WooCommerce Photo Reviews plugin to version 1.4.5 or later immediately. If immediate patching is not possible, disable the plugin temporarily and implement Web Application Firewall (WAF) rules to filter malicious script injections. Review user accounts for suspicious activity and reset compromised sessions.

🔧 خطوات المعالجة (العربية)

قم بتحديث إضافة WooCommerce Photo Reviews إلى الإصدار 1.4.5 أو أحدث فوراً. إذا لم يكن التحديث ممكناً على الفور، قم بتعطيل الإضافة مؤقتاً وتطبيق قواعد جدار حماية تطبيقات الويب لتصفية حقن البرامج النصية الضارة. راجع حسابات المستخدمين للكشف عن النشاط المريب وأعد تعيين الجلسات المخترقة.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.13.1.1 A.14.2.1

🔵 SAMA CSF

ID.RA-1 PR.DS-6

🟡 ISO 27001:2022

A.12.6.1 A.14.2.1

🔗 References & Sources 1

🔗

https://patchstack.com/database/Wordpress/Plugin/woocommerce-photo-reviews/vulnerabilit...

audit@patchstack.com

📊 CVSS Score

5.3

/ 10.0 — Medium

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityL — Low / Local

AvailabilityN — None / Network

📋 Quick Facts

Severity Medium

CVSS Score5.3

CWECWE-80

Exploit No

Patch ✗ No

Published 2026-02-26

Source Feed nvd

🇸🇦 Saudi Risk Score

5.0

/ 10.0 — Saudi Risk

Priority: MEDIUM

🏷️ Tags

CWE-80

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-28132

Introduce Yourself

Sign In Required