WP Customer Area EUVD-2026-116778

Exploitation requires a victim with an active session to follow an attacker-crafted link whose parameter value is reflected unsanitized into a page generated by WP Customer Area (versions up to and including 8.4.1); the exact vulnerable parameter or endpoint is not described in the available sources. The attacker needs no authentication (PR:N) but cannot trigger the flaw without user interaction (UI:R), which is the primary limiting factor - there is no autonomous, server-side-only path. Impact is further bounded to what script execution in the victim's browser can achieve (low confidentiality and integrity effect), and realistic targeting typically aims at privileged users such as site administrators to maximize value.

This is a reflected cross-site scripting flaw (CWE-79) in the WP Customer Area WordPress plugin, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS vector signals network reachability (AV:N), low complexity (AC:L), no attacker privileges (PR:N), a required user interaction (UI:R), a changed scope (S:C), and limited confidentiality/integrity/availability impact (C:L/I:L/A:L) - a profile typical of reflected XSS where impact lands in the victim's browser session rather than the server. The vuln.today priority is 'this_week', reported by Patchstack. No CISA KEV listing is present and no EPSS score was supplied, so there is no quantitative exploitation-probability signal; the only reference is a Patchstack vulnerability-database advisory, not an exploit, so there is no public exploit identified at time of analysis. The practical risk is moderate and gated by the UI:R requirement: an attacker cannot act purely server-side but must lure a victim into clicking a crafted link. This reads as a genuine but not emergency priority - the 'this_week' label and 7.1 score reflect a scope-changing XSS that is still bounded by the need for user interaction and by low per-dimension impact, rather than a wormable or actively exploited bug. EPSS and KEV data are absent (not conflicting), so prioritization rests on the CVSS vector and the Patchstack advisory alone.

An attacker crafts a URL for an affected WP Customer Area endpoint that reflects attacker-controlled input unsanitized into the generated page, then delivers it to a logged-in user (e.g. an administrator or customer) via email, chat, or a malicious page. When the victim opens the link, the injected script executes in their browser in the site's context, allowing session-token theft, actions on the victim's behalf, or page content manipulation. No verified working exploit code was identified in the provided sources.