{"id":"CVE-2026-116551","kind":"vulnerability","aliases":["CVE-2026-116551"],"related":[],"title":"WP Customer Area WordPress plugin: stored script injection via display name","description":"The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The WP Customer Area plugin for WordPress does not sanitize the 'display_name' field, so text entered there is saved and later shown to other users without escaping. An attacker with a subscriber account can plant JavaScript that runs in the browser of anyone who opens an affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-customer-area"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/`\n- Treat any version up to and including `8.4.0` as affected","fix":null,"status":"open","published_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:48+00:00","updated_at":"2026-11-06T12:42:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T12:42:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Customer Area WordPress plugin: stored script injection via display name","impact":"medium","summary":"The WP Customer Area plugin for WordPress does not sanitize the 'display_name' field, so text entered there is saved and later shown to other users without escaping. An attacker with a subscriber account can plant JavaScript that runs in the browser of anyone who opens an affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-customer-area","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in other users' browsers, possibly stealing sessions","analyst_note":"Confirm the fixed version from the plugin's changelog or the Wordfence/WPScan entry, since the NVD text gives none.","how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/`\n- Treat any version up to and including `8.4.0` as affected\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the WP Customer Area plugin at version 8.4.0 or earlier where users can register or hold subscriber-level accounts. Sites without this plugin, or where only trusted administrators have accounts, face lower risk. The sources do not describe any configuration that changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4272,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116551':14A,17A '-2026':13A,16A '8.4.0':103C 'access':123C,139C 'account':60B 'affect':74B 'anyon':70B 'arbitrari':128C 'area':3A,26B,30B,79C 'attack':56B,118C 'authent':117C 'browser':68B 'cross':88C 'cross-sit':87C 'custom':2A,25B,29B,78C 'cve':12A,15A 'display':10A,38B,93C 'due':104C 'enter':43B 'escap':54B,111C 'execut':135C 'field':40B 'host':21B 'includ':102C 'inject':8A,127C,141C 'input':107C 'insuffici':106C 'javascript':63B 'later':48B 'level':122C 'make':113C 'name':11A,39B,94C 'open':72B 'output':110C 'packag':18B 'page':75B,132C,142C 'paramet':95C 'plant':62B 'plugin':5A,31B,80C 'possibl':115C 'run':65B 'sanit':36B,108C 'save':46B 'script':7A,90C,130C 'self':20B 'self-host':19B 'shown':49B 'site':89C 'store':6A,86C 'subscrib':59B,121C 'subscriber-level':120C 'text':42B 'user':52B,138C 'version':98C 'via':9A,91C 'vulner':84C 'web':129C 'whenev':136C 'without':53B 'wordpress':4A,22B,33B,82C 'wp':1A,24B,28B,77C 'wp-customer-area':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area plugin at version 8.4.0 or earlier where users can register or hold subscriber-level accounts. Sites without this plugin, or where only trusted administrators have accounts, face lower risk. The sources do not describe any configuration that changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpcustomerarea"],"campaign_type":null,"search_a":"'-116551':14A,17A '-2026':13A,16A 'area':3A 'custom':2A 'cve':12A,15A 'display':10A 'inject':8A 'name':11A 'plugin':5A 'script':7A 'store':6A 'via':9A 'wordpress':4A 'wp':1A","search_b":"'account':60B 'affect':74B 'anyon':70B 'area':26B,30B 'attack':56B 'browser':68B 'custom':25B,29B 'display':38B 'enter':43B 'escap':54B 'field':40B 'host':21B 'javascript':63B 'later':48B 'name':39B 'open':72B 'packag':18B 'page':75B 'plant':62B 'plugin':31B 'run':65B 'sanit':36B 'save':46B 'self':20B 'self-host':19B 'shown':49B 'subscrib':59B 'text':42B 'user':52B 'without':53B 'wordpress':22B,33B 'wp':24B,28B 'wp-customer-area':23B","search_c":"'8.4.0':103C 'access':123C,139C 'arbitrari':128C 'area':79C 'attack':118C 'authent':117C 'cross':88C 'cross-sit':87C 'custom':78C 'display':93C 'due':104C 'escap':111C 'execut':135C 'includ':102C 'inject':127C,141C 'input':107C 'insuffici':106C 'level':122C 'make':113C 'name':94C 'output':110C 'page':132C,142C 'paramet':95C 'plugin':80C 'possibl':115C 'sanit':108C 'script':90C,130C 'site':89C 'store':86C 'subscrib':121C 'subscriber-level':120C 'user':138C 'version':98C 'via':91C 'vulner':84C 'web':129C 'whenev':136C 'wordpress':82C 'wp':77C","first_public_at":"2026-11-06T12:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116551","severity":null,"published_at":"2026-11-06T12:17:17+00:00","modified_at":"2026-11-06T12:17:17+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}