WP Customer Area CVE-2026-119524

Exploitation requires an authenticated account with sufficient privilege to store content handled by WP Customer Area (PR:L), and success further depends on a victim with an active session viewing the attacker-controlled page (UI:R) - the payload does not execute until rendered. These two factors (needing valid low-privilege credentials and a victim rendering the content) materially limit real-world exploitation compared to an unauthenticated flaw. The specific plugin field or feature that fails to neutralize input is not described in the available sources. Affected: WP Customer Area from an unspecified version through 8.4.3.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the WP Customer Area WordPress plugin, reported by Patchstack. The signals are internally consistent and point to a real-but-not-urgent issue rather than a top priority. The vector requires low-privilege authentication (PR:L) and victim interaction (UI:R), which bounds real-world impact: an attacker needs an existing account capable of storing content, and a privileged user must subsequently render the malicious page. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with the modest score. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was supplied, so widespread exploitation probability cannot be quantified from this data. The only reference is a Patchstack database advisory, which is a vendor disclosure, not verified working exploit code. Net: a legitimate issue to remediate on a normal patch cycle, not a high-CVSS-but-illusory risk, but also not an emergency. Key missing data: no EPSS, no explicit fixed version in the supplied evidence, and no independent confirmation of the exact privilege level required to store the payload.

An attacker holding a low-privilege authenticated account on a WP Customer Area site injects a malicious script into a field that the plugin stores and later renders without proper neutralization. When an administrator or another user views the affected page, the script executes in their browser session, enabling actions such as session/cookie theft or admin-context actions. No public exploit identified at time of analysis; only a Patchstack advisory reference is provided.