WP Customer Area EUVD-2026-114311

Exploitation requires the attacker to hold at least a Subscriber-level authenticated account on the target WordPress site (PR:L), and requires a victim with access to the affected WP Customer Area content to view it, triggering the injected script (UI:R). The specific input field, parameter, or feature that fails sanitization is not described in the available sources. Limiting factors: the need for a valid account (though Subscriber is low and often self-registerable), required victim interaction, and only Low confidentiality/integrity/availability impact; the exploit is confined to WP Customer Area plugin versions 8.4.0 and earlier. The exact trigger mechanism is not stated in the provided references.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79, CVSS 6.5) in the WP Customer Area WordPress plugin at versions <= 8.4.0, reported by Patchstack. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) is internally consistent with a classic authenticated XSS: network vector, low complexity, but requiring at least Subscriber-level authentication (PR:L) and victim user interaction (UI:R), with a scope change (S:C) reflecting script execution in another user's browser context. No EPSS probability is provided in the input and the vulnerability is NOT listed in CISA KEV, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis,' though a public Patchstack database reference exists; it is not verified as working exploit code. The 'this_month' vuln.today decision label indicates a routine prioritization rather than emergency action. Overall this is a real but lower-tier priority: the need for a valid (even low-privilege Subscriber) account plus user interaction, combined with only Low impact across C/I/A, meaningfully limits real-world weaponization compared with an unauthenticated flaw. The low Subscriber privilege barrier is notable because many WordPress sites allow open subscriber registration, which can turn PR:L into an effectively low bar.

An attacker with a Subscriber-level account (obtainable via open registration on many WordPress sites) injects a malicious script payload through a WP Customer Area input field that is not properly sanitized or output-encoded. When a higher-privileged user such as an administrator or staff member views the affected area, the stored script executes in their authenticated browser session (scope change), potentially enabling session/cookie theft or actions in the admin context. No verified working public exploit is identified; only a Patchstack advisory reference exists.