{"id":"CVE-2026-120365","kind":"vulnerability","aliases":["CVE-2026-120365"],"related":[],"title":"WP Customer Area WordPress plugin: stored XSS through versions up to 8.4.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.","summary":"WP Customer Area, a WordPress plugin by Aguila Technologies, has a stored cross-site scripting flaw in versions through 8.4.3. An attacker who can store input in the plugin can run JavaScript in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wordpress","wp-customer-area"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or with `wp plugin get customer-area --field=version`\n- Compare the result against the affected range, which runs through `8.4.3`","fix":null,"status":"open","published_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:22+00:00","updated_at":"2026-11-07T11:48:22+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T11:48:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Customer Area WordPress plugin: stored XSS through versions up to 8.4.3","impact":"medium","summary":"WP Customer Area, a WordPress plugin by Aguila Technologies, has a stored cross-site scripting flaw in versions through 8.4.3. An attacker who can store input in the plugin can run JavaScript in other users' browsers.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-customer-area","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the site","analyst_note":"Confirm the fixed version and which roles can store the malicious input, from the NVD entry or the vendor's plugin changelog.","how_to_check":"- Check the installed WP Customer Area plugin version in the WordPress admin under Plugins, or with `wp plugin get customer-area --field=version`\n- Compare the result against the affected range, which runs through `8.4.3`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Customer Area WordPress plugin at or below `8.4.3`. The flaw is stored XSS, so exposure depends on who can submit content the plugin saves and who views it; the sources do not say which roles or settings are needed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4220,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120365':15A,18A '-2026':14A,17A '8.4.3':12A,48B,98C 'affect':91C 'aguila':35B,79C 'allow':87C 'area':3A,27B,30B,83C,86C,94C 'attack':50B 'browser':64B 'cross':41B,74C 'cross-sit':40B,73C 'custom':2A,26B,29B,82C,85C,93C 'customer-area':84C 'cve':13A,16A 'flaw':44B 'generat':72C 'host':22B 'improp':65C 'input':54B,68C 'issu':90C 'javascript':60B 'n/a':96C 'neutral':66C 'page':71C 'plugin':5A,33B,57B 'run':59B 'runtim':19B 'script':43B,76C 'self':21B 'self-host':20B 'site':42B,75C 'store':6A,39B,53B,88C 'technolog':36B,80C 'user':63B 'version':9A,46B 'vulner':77C 'web':70C 'wordpress':4A,23B,32B 'wp':1A,25B,28B,81C,92C 'wp-customer-area':24B 'xss':7A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area WordPress plugin at or below `8.4.3`. The flaw is stored XSS, so exposure depends on who can submit content the plugin saves and who views it; the sources do not say which roles or settings are needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","runtime","selfhosted","wordpress","wpcustomerarea"],"campaign_type":null,"search_a":"'-120365':15A,18A '-2026':14A,17A '8.4.3':12A 'area':3A 'custom':2A 'cve':13A,16A 'plugin':5A 'store':6A 'version':9A 'wordpress':4A 'wp':1A 'xss':7A","search_b":"'8.4.3':48B 'aguila':35B 'area':27B,30B 'attack':50B 'browser':64B 'cross':41B 'cross-sit':40B 'custom':26B,29B 'flaw':44B 'host':22B 'input':54B 'javascript':60B 'plugin':33B,57B 'run':59B 'runtim':19B 'script':43B 'self':21B 'self-host':20B 'site':42B 'store':39B,53B 'technolog':36B 'user':63B 'version':46B 'wordpress':23B,32B 'wp':25B,28B 'wp-customer-area':24B","search_c":"'8.4.3':98C 'affect':91C 'aguila':79C 'allow':87C 'area':83C,86C,94C 'cross':74C 'cross-sit':73C 'custom':82C,85C,93C 'customer-area':84C 'generat':72C 'improp':65C 'input':68C 'issu':90C 'n/a':96C 'neutral':66C 'page':71C 'script':76C 'site':75C 'store':88C 'technolog':80C 'vulner':77C 'web':70C 'wp':81C,92C 'xss.this':89C","first_public_at":"2026-11-07T11:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120365","severity":null,"published_at":"2026-11-07T11:16:59+00:00","modified_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}