{"id":"CVE-2026-116854","kind":"vulnerability","aliases":["CVE-2026-116854"],"related":[],"title":"WP Customer Area WordPress plugin: subscriber stored XSS up to 8.4.0","description":"Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.","summary":"The WP Customer Area WordPress plugin, versions up to and including 8.4.0, has a cross-site scripting flaw that a subscriber-level account can use. An attacker with a subscriber account can inject script that runs in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-customer-area"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed","plugin-version-above-8.4.0"],"how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins\n- Look for `wp-customer-area` in the plugins directory and read its version header","fix":"- Move WP Customer Area to a version later than `8.4.0`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-30T19:18:15+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:23+00:00","updated_at":"2026-10-30T19:26:23+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move WP Customer Area to a version later than `8.4.0`; the exact fixed version is unknown from the sources","reach":"internet","title":"WP Customer Area WordPress plugin: subscriber stored XSS up to 8.4.0","impact":"medium","summary":"The WP Customer Area WordPress plugin, versions up to and including 8.4.0, has a cross-site scripting flaw that a subscriber-level account can use. An attacker with a subscriber account can inject script that runs in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-customer-area"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in other users' browsers on the site","analyst_note":"Confirm the fixed plugin version and the vulnerable input path from the NVD entry or the vendor changelog.","how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins\n- Look for `wp-customer-area` in the plugins directory and read its version header\n- unknown whether other check methods are needed","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-8.4.0","no-subscriber-accounts"],"who_is_affected":"Sites running the WP Customer Area plugin at version 8.4.0 or earlier are exposed. An attacker needs a subscriber account on the site to exploit the flaw, so sites without customer or subscriber registration carry less risk. unknown whether the vulnerable input path is reachable on every configuration.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4065,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116854':14A,17A '-2026':13A,16A '8.4.0':11A,35B,75C 'account':48B,56B 'area':3A,23B,27B,74C 'attack':52B 'browser':65B 'cross':39B,67C 'cross-sit':38B 'custom':2A,22B,26B,73C 'cve':12A,15A 'flaw':42B 'includ':34B 'inject':58B 'level':47B 'packag':18B 'plugin':5A,29B 'run':61B 'script':41B,59B,69C 'site':40B,68C 'store':7A 'subscrib':6A,46B,55B,66C 'subscriber-level':45B 'use':50B 'user':64B 'version':30B,76C 'wordpress':4A,19B,28B 'wp':1A,21B,25B,72C 'wp-customer-area':20B 'xss':8A,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area plugin at version 8.4.0 or earlier are exposed. An attacker needs a subscriber account on the site to exploit the flaw, so sites without customer or subscriber registration carry less risk. unknown whether the vulnerable input path is reachable on every configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116854","severity":null,"published_at":"2026-10-30T19:18:15+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}