What is the CVSS score of CVE-2026-7640?

CVE-2026-7640 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Customer Area CVE-2026-7640

EUVD-2026-43612 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 Wordfence

GHSA-prrr-x57g-5wrp

WordPress XSS Wp Customer Area Wordpress Plugin Aguilatechnologies

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects mandatory Contributor authentication; UI:R corrects the provided UI:N since victim page-visit is required for payload execution.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 02:31 vuln.today

CVE Published

Jul 14, 2026 - 01:30 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the customer-area-protected-content shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Customer Area WordPress plugin (versions up to and including 8.3.5) allows authenticated attackers with Contributor-level access or above to persistently inject arbitrary JavaScript via the unsanitized 'type' attribute of the customer-area-protected-content shortcode. The injected payload executes in the browser of any user who visits the compromised page, enabling session hijacking, credential theft, or malicious redirects against site visitors. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; however, the Contributor-level prerequisite is a low barrier in multi-author WordPress environments.

Technical ContextAI

WP Customer Area (CPE: cpe:2.3:a:aguilatechnologies:wp_customer_area:*:*:*:*:*:*:*:*) is a WordPress plugin developed by Aguila Technologies that provides customer portal functionality via shortcodes. The vulnerable code path resides in protected-content-shortcode.class.php (line 90 in 8.3.4, lines 88-91 in the trunk and 8.3.6 fix tag), where the 'type' parameter accepted by the [customer-area-protected-content] shortcode is neither sanitized on input nor escaped on output before being rendered into the page DOM. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) - a stored variant - because the unsanitized attribute value is persisted in post content and replayed to all page visitors. The CVSS Scope:Changed metric confirms the vulnerability crosses a security boundary from the WordPress application context into the victim's browser context.

RemediationAI

Update WP Customer Area to version 8.3.6 or later, which contains the corrected shortcode attribute handling at the vulnerable code path (protected-content-shortcode.class.php lines 88-91). The fix is referenced via the WordPress plugin Trac at https://plugins.trac.wordpress.org/browser/customer-area/tags/8.3.6/. Detailed vulnerability intelligence is available via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f96cec-ddcb-45b2-a28c-b4e7b6f5c719. As a compensating control prior to patching, administrators should audit and restrict Contributor-level accounts to only trusted users, as this reduces the attacker pool; note that this does not eliminate the risk if any Contributor account is compromised. Additionally, a WordPress WAF rule (such as those available in Wordfence Premium) can block shortcode-based XSS injection attempts, though WAF rules may conflict with legitimate shortcode usage and require testing.