Live › vulnerability › CVE-2026-116854
The WP Customer Area WordPress plugin, versions up to and including 8.4.0, has a cross-site scripting flaw that a subscriber-level account can use. An attacker with a subscriber account can inject script that runs in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the WP Customer Area plugin at version 8.4.0 or earlier are exposed. An attacker needs a subscriber account on the site to exploit the flaw, so sites without customer or subscriber registration carry less risk. unknown whether the vulnerable input path is reachable on every configuration.
No product ranges from the sources yet.
wp-customer-area in the plugins directory and read its version header8.4.0; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116854")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.