CVE-2026-57666: WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Customer Areato a version that resolves this vulnerability.Fixed in 8.4.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity and without authentication, but it requires user interaction. The attacker would need to cause a user to interact with a crafted request or page containing the reflected payload.
Which versions should be considered affected?
WP Customer Area versions through 8.4.1 are affected. The available data does not identify a fixed version.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. Because the scope is changed, the impact may extend beyond the vulnerable plugin's security authority.