[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3w4auOSsd2-i0MUW2b2LGofvIil2GEyS7AR-vgAEs14":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-13771","customer-reviews-for-woocommerce-authenticated-contributor-stored-cross-site-scripting-via-color-shortcode-attribute","Customer Reviews for WooCommerce \u003C= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute","The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","customer-reviews-woocommerce",null,"\u003C=5.113.0","5.114.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-09 06:52:51",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff286e61a-1afc-4f51-8b53-f3456a20150a?source=api-prod",1,[22,23,24,25,26,27,28,29],"class-ivole.php","css\u002Ffrontend.css","includes\u002Ftrust-badge\u002Fclass-cr-trust-badge.php","ivole.php","readme.txt","templates\u002Fbadge-small.php","templates\u002Fbadge-wide-vs.php","templates\u002Fbadge-wide.php","researched",false,3,"I cannot fulfill your request to produce a detailed exploitation research plan or actionable payloads for this vulnerability. My safety guidelines prohibit the generation of instructions, specific HTTP requests, or functional payloads that facilitate the exploitation of security flaws.\n\nInstead, I can discuss the underlying security principles and theoretical mechanics involved in this type of vulnerability and how to defend against them in WordPress development.\n\n### Technical Analysis: Insufficient Input Validation and Output Escaping\n\nThe vulnerability described (Stored XSS via a shortcode attribute) typically stems from two primary failures in the security lifecycle:\n\n1.  **Weak Input Validation (Sanitization):** When processing shortcode attributes, it is crucial to ensure that the input strictly conforms to the expected format. If a regular expression is used for validation, it must be anchored to both the start (`^`) and end (`$`) of the string. Without these anchors, a pattern-matching function (like `preg_match`) may return true if a valid pattern exists *anywhere* in the string, even if the rest of the string contains malicious content (e.g., `#ffffff\";onload=\"alert(1)\"`).\n2.  **Missing Output Escaping:** Regardless of the sanitization applied at the input stage, data must always be escaped at the point of output (the \"sink\"). In WordPress, this means using context-specific functions such as `esc_attr()` when placing data into HTML attributes or `esc_html()` when placing data into the HTML body. If a variable is concatenated directly into a string that forms an HTML tag or attribute, an attacker can use special characters like quotes and brackets to \"break out\" of the intended context and execute arbitrary JavaScript.\n\n### General Defensive Best Practices\n\nTo secure WordPress plugins against such vulnerabilities, researchers and developers should focus on the following:\n\n*   **Validate on Input:** Use strict validation for all user-controllable input, including shortcode attributes. For colors, ensure the value is a valid hex code or a predefined safe string.\n*   **Escape on Output:** Always use the appropriate WordPress escaping function at the final moment of output. For data reflected in a `style` attribute, additional care must be taken to ensure the CSS property values are also safe.\n*   **Principle of Least Privilege:** Ensure that sensitive functionality is restricted to the appropriate user roles and protected by capability checks (`current_user_can()`) and nonces (`check_admin_referer()` or `check_ajax_referer()`).\n\nFor further information on securing WordPress code, you may search for the **\"WordPress Plugin Handbook: Security\"** and the **\"OWASP Guide to Cross-Site Scripting (XSS)\"** online.","gemini-3-flash-preview","2026-07-16 15:14:51","2026-07-16 15:16:03",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","5.113.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomer-reviews-woocommerce\u002Ftags\u002F5.113.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustomer-reviews-woocommerce.5.113.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomer-reviews-woocommerce\u002Ftags\u002F5.114.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustomer-reviews-woocommerce.5.114.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomer-reviews-woocommerce\u002Ftags"]