CVE-2026-119524: WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

Q: Which deployments are affected?

WP Customer Area versions through 8.4.3 are affected. The available information does not identify any unaffected fixed version.

Q: What level of access does an attacker need?

The vulnerability has a low-privileges requirement and requires user interaction. It is remotely reachable and does not require a complex attack.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in stored cross-site scripting. The supplied severity vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

Affected Software

1 affected component

Aguila Technologies WP Customer Area<=8.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Aguila Technologies WP Customer Area customer-area to a version that resolves this vulnerability.
Fixed in 8.4.4

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

WP Customer Area versions through 8.4.3 are affected. The available information does not identify any unaffected fixed version.

What level of access does an attacker need?

The vulnerability has a low-privileges requirement and requires user interaction. It is remotely reachable and does not require a complex attack.

What is the potential impact of successful exploitation?

Successful exploitation can result in stored cross-site scripting. The supplied severity vector indicates low impact to confidentiality, integrity, and availability, with scope changed.

CVE-2026-119524: WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What is the potential impact of successful exploitation?