{"id":"CVE-2026-119524","kind":"vulnerability","aliases":["CVE-2026-119524"],"related":[],"title":"WP Customer Area WordPress plugin: stored XSS through version 8.4.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.","summary":"The WP Customer Area WordPress plugin by Aguila Technologies stores user-supplied input without neutralizing it, so injected scripts are saved and run in other users' browsers. An attacker who can get script into a stored field can read session data or act as the victim on the site.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"customer-area","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","wordpress","wp-customer-area"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/customer-area`.\n- Confirm whether the installed version is `8.4.3` or earlier.","fix":null,"status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:45+00:00","updated_at":"2026-11-09T11:26:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Customer Area WordPress plugin: stored XSS through version 8.4.3","impact":"medium","summary":"The WP Customer Area WordPress plugin by Aguila Technologies stores user-supplied input without neutralizing it, so injected scripts are saved and run in other users' browsers. An attacker who can get script into a stored field can read session data or act as the victim on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-customer-area"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other users' browsers, enabling session theft or account actions.","analyst_note":"Confirm the fixed version and required privileges from the WordPress plugin page or the Wordfence/NVD entry for CVE-2026-119524.","how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/customer-area`.\n- Confirm whether the installed version is `8.4.3` or earlier.","plain_action":"","product_name":"customer-area","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Customer Area WordPress plugin at version 8.4.3 or earlier are in scope. The flaw is stored XSS, so exposure depends on which users can submit content that the plugin later renders to other visitors, such as customer account fields. The sources do not say which features or roles are needed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4548,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119524':13A,16A '-2026':12A,15A '8.4.3':10A,109C 'act':69B 'affect':102C 'aguila':33B,90C 'allow':98C 'area':3A,19A,25B,29B,94C,97C,105C 'attack':55B 'browser':53B 'cross':85C 'cross-sit':84C 'custom':2A,24B,28B,93C,96C,104C 'customer':18A 'customer-area':17A,95C 'cve':11A,14A 'data':67B 'field':63B 'generat':83C 'get':58B 'improp':76C 'inject':44B 'input':39B,79C 'issu':101C 'n/a':107C 'neutral':41B,77C 'packag':20B 'page':82C 'plugin':5A,31B 'read':65B 'run':49B 'save':47B 'script':45B,59B,87C 'session':66B 'site':75B,86C 'store':6A,35B,62B,99C 'suppli':38B 'technolog':34B,91C 'user':37B,52B 'user-suppli':36B 'version':9A 'victim':72B 'vulner':88C 'web':81C 'without':40B 'wordpress':4A,21B,30B 'wp':1A,23B,27B,92C,103C 'wp-customer-area':22B 'xss':7A 'xss.this':100C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area WordPress plugin at version 8.4.3 or earlier are in scope. The flaw is stored XSS, so exposure depends on which users can submit content that the plugin later renders to other visitors, such as customer account fields. The sources do not say which features or roles are needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["customerarea"],"ptokens":["area","customer"],"labels":["medium","package","vendor","wordpress","wpcustomerarea"],"campaign_type":null,"search_a":"'-119524':13A,16A '-2026':12A,15A '8.4.3':10A 'area':3A,19A 'custom':2A 'customer':18A 'customer-area':17A 'cve':11A,14A 'plugin':5A 'store':6A 'version':9A 'wordpress':4A 'wp':1A 'xss':7A","search_b":"'act':69B 'aguila':33B 'area':25B,29B 'attack':55B 'browser':53B 'custom':24B,28B 'data':67B 'field':63B 'get':58B 'inject':44B 'input':39B 'neutral':41B 'packag':20B 'plugin':31B 'read':65B 'run':49B 'save':47B 'script':45B,59B 'session':66B 'site':75B 'store':35B,62B 'suppli':38B 'technolog':34B 'user':37B,52B 'user-suppli':36B 'victim':72B 'without':40B 'wordpress':21B,30B 'wp':23B,27B 'wp-customer-area':22B","search_c":"'8.4.3':109C 'affect':102C 'aguila':90C 'allow':98C 'area':94C,97C,105C 'cross':85C 'cross-sit':84C 'custom':93C,96C,104C 'customer-area':95C 'generat':83C 'improp':76C 'input':79C 'issu':101C 'n/a':107C 'neutral':77C 'page':82C 'script':87C 'site':86C 'store':99C 'technolog':91C 'vulner':88C 'web':81C 'wp':92C,103C 'xss.this':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119524","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}