WP Customer Reviews
WP Customer Reviews has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (63%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.
Every one of the 8 issues recorded for WP Customer Reviews has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, most of them (2) reported by Marco Wotschka. WP Customer Reviews is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2016-10902WP Customer Reviews <= 3.0.8 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP Customer Reviews
Author
Aaron Queen
There are many sites that are crawling for user-generated reviews now, including Google Places and Google Local Search. WP Customer Reviews allows you to setup a specific page on your blog to receive customer testimonials for your business/service OR to write reviews about a product. WP Multisite and Multiuser (WPMU / WPMS / WordPress MU) compatible. All submissions are moderated, which means that YOU choose which reviews get shown. Reviews are displayed to visitors in a friendly format, but search engines see the Schema.org microformat. Multiple anti-spam measures to prevent automated spambots from submitting reviews. Completely customizable, including which fields to ask for, require, and show. Shortcodes available for inserting reviews and review form on any page or widget. Works with caching plugins and custom themes. Includes an external stylesheet so you can modify it to better fit your theme. Reviews can be edited by admin for content and date. Admin responses can be made and shown under each review. Support for adding your own custom fields. The plugin can be used on more than one page, and can be used on posts. Supports both Business and Product review types. Shows aggregate reviews microformat. Fast and lightweight, even including the star rating image. This plugin will not slow down your blog. Validates as valid XHTML 1.1 (W3C) and valid Microformats (Rich Snippets Testing Tool). And much more… Almost every new feature that has been added was due to the generous support and suggestions of our users. If you have a suggestion or question, do not hesitate to ask in our forum. More information at: WP Customer Reviews
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C