What is the CVSS score of CVE-2026-15324?

CVE-2026-15324 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Customize My Account CVE-2026-15324

EUVD-2026-44902 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-3xrj-6q9q-73hr

WordPress XSS Wordpress Plugin Sysbasics Customize My Account For Woocommerce Live My Account Customizer Phppoet

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

PR:H reflects mandatory shop manager authentication; UI:R because a victim must visit the injected page to complete exploitation; S:C captures cross-user stored XSS impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:09 vuln.today

CVE Published

Jul 16, 2026 - 08:26 cve.org

MEDIUM 4.4

DescriptionCVE.org

The SysBasics Customize My Account for WooCommerce - Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the SysBasics Customize My Account for WooCommerce plugin (all versions through 4.4.14) allows authenticated shop managers to persist malicious scripts via the unsanitized 'row_type' parameter, executing in any user's browser upon visiting the compromised My Account page. The CVSS scope change (S:C) confirms cross-user impact - injected scripts run in victim sessions, enabling session hijacking or credential theft beyond the attacker's own context. No public exploit code or CISA KEV listing is confirmed at time of analysis; risk is substantially gated by the shop manager privilege requirement.

Technical ContextAI

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant, arising from the plugin's failure to sanitize the 'row_type' input parameter before persisting it and escaping it on output. Wordfence identifies three vulnerable code paths in plugin version 4.4.14: templates/myaccount/navigation/02.php at line 187 (frontend rendering), include/admin/endpoint_form_response.php at line 9 (AJAX endpoint handling), and include/admin/admin_settings.php at line 144 (backend settings processing). The plugin, identified by CPE cpe:2.3:a:phppoet:sysbasics_customize_my_account_for_woocommerce_-_live_my_account_customizer:*:*:*:*:*:*:*:*, extends WooCommerce's native 'My Account' page with custom navigation and layout configuration. Because row_type data is stored server-side and rendered to all visiting users, a single privileged injection creates a persistent threat to all subsequent visitors.

RemediationAI

Update the Customize My Account for WooCommerce plugin beyond version 4.4.14 as soon as a patched release is confirmed available in the WordPress plugin repository; the upstream fix has been committed (SVN changeset 3606867 at https://plugins.trac.wordpress.org/changeset?reponame=&old=3606867%40customize-my-account-for-woocommerce&new=3606867%40customize-my-account-for-woocommerce), but the exact released version number has not been independently confirmed from available data - verify the current version in the WordPress admin dashboard or plugin repository before updating. As a compensating control pending patch deployment, restrict shop manager role assignments to fully trusted accounts only, as the attack requires that privilege level; removing or demoting untrusted shop managers eliminates the attack surface entirely. Optionally, a WAF rule blocking script-bearing input in the row_type parameter on WooCommerce admin endpoints can provide layered defense, though this may interfere with legitimate customization workflows. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b2371b84-bb56-4e5d-afce-cd33f2ee9316 should be monitored for patched version confirmation.