Yes, any feature that stores text from visitors and shows it to others can cause stored cross site scripting if output is not handled safely. Reviews, questions, wish list names and support chats all qualify. The defense is output encoding and, where HTML is allowed, sanitization.
Why this matters on a store
Stored XSS runs an attacker's script in every buyer's browser who views the page. On a product page that can mean stealing session cookies, rewriting prices on screen, or adding a fake payment form. The attacker needs only a free account and a review box.
What OWASP says to do
OWASP's XSS Prevention Cheat Sheet states the philosophy plainly: every variable in a web application needs protection, and variables should be validated and then escaped or sanitized. It adds that modern frameworks reduce XSS through templating and auto escaping, but problems return when developers use escape hatches. Examples it names include React's dangerouslySetInnerHTML without sanitizing, Angular's bypassSecurityTrustAs functions, and Lit's unsafeHTML. It also warns that React 19 blocks javascript URLs in src and href but this does not replace application specific URL validation.
A checklist for user content
- List every place text from visitors is stored and displayed: reviews, questions, nicknames, gift messages, order notes, return reasons, chat transcripts.
- Render each as plain text by default using your framework's escaping.
- If you must allow formatting, sanitize with a maintained HTML sanitizer and an allow list of tags.
- Search the code for escape hatches such as raw HTML insertion, and require a review comment for each one.
- Validate any URL a user can supply, such as a profile link, to allowed schemes.
- Check the admin side too. Order notes shown in a back office screen reach staff, who have more access than buyers.
- Add a Content Security Policy as a second layer. See our guide to what CSP can and cannot stop.
Third party review widgets
If reviews come from an outside widget, the widget vendor owns the rendering. Ask how they handle stored content, and load the widget in a way that limits what it can reach. Our decision guide on iframe or script tag for widgets covers the trade off.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a running app is probed for injection points.
Safeguard offers SAST and DAST scanning, and you can try the free scan at gold.safeguard.sh/scan.
Quick check
Does a framework make me immune?
No. Frameworks escape by default, but escape hatches and unvalidated URLs bring the risk back.
Is filtering the word script enough?
No. Use output encoding and sanitization instead of blocklists.
Sources
Last reviewed: 19 October 2026.
