EUVD-2026-37861
GHSA-7jvm-9fg9-5j8v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attacker is unauthenticated (PR:N) but victim must be an active Shop Manager; scope changes into admin context enabling limited data read and action (C:L/I:L).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The SysBasics Customize My Account for WooCommerce - Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Because the vulnerable plugin_options_page() function is only rendered within the WordPress admin dashboard, successful exploitation requires the targeted victim to be logged in with Shop Manager-level access or higher.
AnalysisAI
Reflected Cross-Site Scripting in the SysBasics Customize My Account for WooCommerce plugin (versions ≤ 4.3.6) enables unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab' parameter in the admin settings page. Exploitation is constrained by a critical precondition: the vulnerable plugin_options_page() function is rendered exclusively in the WordPress admin dashboard, meaning the targeted victim must hold Shop Manager-level access or higher and be socially engineered into clicking a crafted link while authenticated. No public exploit code or CISA KEV listing has been identified at time of analysis; this is a no public exploit identified at time of analysis scenario reported by Wordfence.
Technical ContextAI
The vulnerability resides in the plugin_options_page() function within include/admin/admin_settings.php (lines 622 and 702) of the plugin identified by CPE cpe:2.3:a:phppoet:sysbasics_customize_my_account_for_woocommerce_*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS pattern where user-supplied input in the HTTP query parameter 'tab' is echoed back into the HTML response without proper escaping or sanitization. Because WordPress admin pages share the wp-admin origin with all other backend functions, a successful payload executes in a privileged browser context capable of issuing authenticated AJAX actions, exfiltrating nonces, or performing WooCommerce store management operations on behalf of the victim.
RemediationAI
An upstream source-level fix is available via the WordPress plugin SVN changeset at https://plugins.trac.wordpress.org/changeset?old=3571110%40customize-my-account-for-woocommerce&new=3571110%40customize-my-account-for-woocommerce; however, a specific patched release version number is not independently confirmed from the provided data - administrators should update to the latest available version via the WordPress plugin repository and verify the installed version exceeds 4.3.6. As an interim compensating control, restrict the WordPress admin dashboard to trusted IP ranges using server-level rules (nginx allow/deny directives or Apache Require ip) - note this may impact legitimate remote administrative workflows and does not address the underlying code flaw. Additionally, enforce phishing-resistant multi-factor authentication for all Shop Manager and Administrator accounts to reduce the social-engineering surface, though this does not eliminate the vulnerability. Monitoring admin-panel HTTP requests for URL-encoded script tags in the 'tab' parameter via a WAF rule can provide detection coverage until patching is confirmed.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today