CVE-2026-12137: SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter
The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Because the vulnerable pluginoptionspage() function is only rendered within the WordPress admin dashboard, successful exploitation requires the targeted victim to be logged in with Shop Manager-level access or higher.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SysBasics Customize My Account for WooCommercefrom your environment.Uninstall or deactivate the 'SysBasics Customize My Account for WooCommerce' WordPress plugin until a security fix is available or confirmed safe. If the plugin is required, keep it deactivated for administrative accounts until remediated.
- Compensating control
Restrict access to the WordPress admin dashboard (pages rendering plugin_options_page) to trusted IP addresses or via VPN; apply a Web Application Firewall (WAF) rule to block suspicious input for the 'tab' parameter and limit access to Shop Manager-level and higher accounts.
- Operational
Review all accounts with Shop Manager-level access or higher, remove or disable any unnecessary accounts, force logout of active sessions for high-privilege users, and require administrators to re-authenticate before performing sensitive actions until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12137?
CVE-2026-12137 has a medium severity rating of 6.1.
How do I fix CVE-2026-12137?
To fix CVE-2026-12137, update the SysBasics Customize My Account for WooCommerce plugin to version 4.3.7 or later.
What type of vulnerability is CVE-2026-12137?
CVE-2026-12137 is a reflected cross-site scripting (XSS) vulnerability.
What are the affected versions of SysBasics Customize My Account for WooCommerce in CVE-2026-12137?
CVE-2026-12137 affects all versions up to and including 4.3.6 of the plugin.
What causes the vulnerability in CVE-2026-12137?
The vulnerability in CVE-2026-12137 is caused by insufficient input sanitization and output escaping for the 'tab' parameter.