HDWebmobile Photo & Video Reviews
Let customers attach photos and short videos to their WooCommerce product reviews, shown right in the review list.
Overview
HDWebmobile Photo & Video Reviews adds an optional photo/video upload field to WooCommerce’s own native product review form. Uploaded media is attached to the review and displayed in the review list on the product page, giving shoppers visual, customer-submitted proof alongside the star rating and written review.
A competing “Customer Reviews for WooCommerce” plugin shipped a standalone AJAX action for uploading review photos that performed no authentication, capability, or nonce check at all (CVE-2026-12684), letting any unauthenticated visitor upload arbitrary image/video files straight into the Media Library. This plugin closes that entire vulnerability class by construction rather than patching around it: there is no standalone “upload media” endpoint of any kind, AJAX or otherwise. A file is only ever processed as a side effect of a genuine WordPress comment submission going through wp-comments-post.php — WordPress’s own comment pipeline (spam checks, Akismet if installed, moderation) — never a bespoke always-open surface. A product-scoped nonce, generated with the review form and verified before any file is touched, is required in addition to that. Media is only ever attached to a comment that is confirmed to be a genuine WooCommerce product review, never any other comment type. Every upload goes through wp_handle_upload() — WordPress’s own vetted upload handler — with an explicit image/video mime allow-list, never a hand-rolled file-move.
Key Features
- Optional photo (JPG, PNG, GIF, WebP) and video (MP4, WebM, MOV) upload field added to the native WooCommerce review form — no separate submission flow
- Up to a configurable number of files per review (default 3), each with its own configurable size cap for photos and videos separately
- Uploaded photos display as a thumbnail gallery (click to view full size); videos display as an inline HTML5 player, directly under the review text
- Video uploads can be turned off entirely to accept photos only
- Respects WooCommerce’s own “verified purchase required to review” setting
Limitations
Please read before installing:
- No moderation queue beyond WordPress’s own comment moderation — if a review is held for moderation, its media is still attached but won’t display publicly until the review itself is approved
- No client-side image compression/resizing — large photos are stored at their original resolution (subject to the configured size cap)
- One combined multi-file field for both photos and videos — there is no separate “photos only” vs “video only” field in the UI
Quick Setup
- Upload the plugin files to the /wp-content/plugins/hdwebmobile-photo-video-reviews directory, or install through the Plugins screen directly.
- Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
- Reviews on any product page now show the photo/video upload field automatically — no configuration required to start.
Latest Version
Current stable version in readme: 1.0.0 (Initial release: photo and video upload on the native review form, thumbnail gallery and inline video player, verified-purchase-aware.)
See our other WordPress plugins for more WooCommerce and site-utility tools.