CVE-2026-12136: SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasicsuseravatar' shortcode in versions up to, and including, 4.3.6. This is due to insufficient input sanitization and output escaping on user supplied attributes (minheight, minwidth, maxheight, maxwidth) in the wcmamtxgetavatardefault() function, which are concatenated unescaped into the getavatar() extraattr style attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SysBasics Customize My Account for WooCommercefrom your environment.Uninstall the SysBasics Customize My Account for WooCommerce plugin until a vendor-supplied patch or fixed version is available.
- Configuration
Unregister or disable the 'sysbasics_user_avatar' shortcode to prevent processing of untrusted shortcode attributes (min_height, min_width, max_height, max_width) that lead to stored XSS.
SysBasics Customize My Account for WooCommerce sysbasics_user_avatar shortcode registration = disabled - Compensating control
Limit who can create or edit content that can contain shortcodes: restrict Contributor-level and higher privileges to trusted users, and restrict the ability to insert or save shortcodes until the vulnerability is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12136?
CVE-2026-12136 has a medium severity score of 6.4.
How do I fix CVE-2026-12136?
To fix CVE-2026-12136, update the Customize My Account for WooCommerce plugin to version 4.3.7 or later.
What type of vulnerability is CVE-2026-12136?
CVE-2026-12136 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-12136?
Users of the Customize My Account for WooCommerce plugin version 4.3.6 and earlier are affected by CVE-2026-12136.
What causes the vulnerability in CVE-2026-12136?
The vulnerability in CVE-2026-12136 is caused by insufficient input sanitization and output escaping for user supplied attributes.