What is the CVSS score of CVE-2026-57358?

CVE-2026-57358 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Customize My Account for WooCommerce are affected by CVE-2026-57358?

Organizations using the Customize My Account for WooCommerce plugin (versions 4.3.9 or earlier) face a critical risk: unauthenticated attackers can send users specially crafted links that execute…

How to fix or mitigate CVE-2026-57358?

Within 24 hours: Identify all WordPress instances running Customize My Account for WooCommerce versions 4.3.9 or earlier; notify users and administrators to avoid clicking suspicious links from untrusted sources. Within 7 days: Disable the plugin or implement Web Application Firewall (WAF) rules blocking reflected XSS payloads; deploy Content Security Policy (CSP) headers set to 'script-src: self'. Within 30 days: Monitor WooCommerce security advisories for patch release; evaluate and deploy alternative account customization plugins; validate remediation completion across all instances.

Customize My Account for WooCommerce CVE-2026-57358

EUVD-2026-41357 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-2649-c4jx-cgj8

WordPress XSS Wordpress Plugin Customize My Account For Woocommerce Sysbasics

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable reflected XSS needing a victim click (UI:R) with cross-context script execution (S:C) yielding limited browser-side C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:16 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

AnalysisAI

Reflected Cross-Site Scripting in the Customize My Account for WooCommerce WordPress plugin (versions 4.3.9 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The flaw carries a CVSS 7.1 rating driven by a scope change (S:C), meaning script execution crosses the plugin's security boundary into the wider WordPress session context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a commercial WordPress plugin published by sysbasics (CPE cpe:2.3:a:sysbasics:customize_my_account_for_woocommerce) that extends the WooCommerce 'My Account' area with custom layouts and content. The weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), the root-cause class for XSS: user-controlled input is reflected into an HTML response without proper output encoding or input sanitization. Because it is reflected and unauthenticated, the malicious payload is not stored server-side but is echoed back in a response to a request an attacker induces the victim to make, executing in the victim's authenticated browser session on the WordPress site.

RemediationAI

No vendor-released patch version is identified in the available data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/customize-my-account-for-woocommerce/vulnerability/wordpress-customize-my-account-for-woocommerce-plugin-4-3-9-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for a release newer than 4.3.9 and upgrade to it as soon as one is confirmed. Until a fix is verified, compensating controls include deploying a Web Application Firewall (such as Patchstack's or a WordPress-focused WAF) with XSS rules to filter reflected script payloads in requests to the plugin's endpoints (trade-off: rule tuning may cause false positives on legitimate query strings), enforcing a strict Content-Security-Policy that disallows inline script execution to blunt payload impact (trade-off: may break themes/plugins relying on inline JS), and deactivating the Customize My Account for WooCommerce plugin if it is non-essential (trade-off: loss of the custom My Account layout functionality). User awareness against clicking untrusted links targeting the site also reduces the practical attack surface given the UI:R requirement.