{"id":"CVE-2026-54861","kind":"vulnerability","aliases":["CVE-2026-54861"],"related":[],"title":"WP Customer Area WordPress plugin: reflected XSS through version 8.4.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.","summary":"The WP Customer Area WordPress plugin does not neutralize input before writing it into a page, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-customer-area"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WP Customer Area plugin (customer-area) is installed on the WordPress site, in the plugins list or `wp plugin list`\n- Compare the installed version against the affected range, which runs through `8.4.1`","fix":"- WP Customer Area: unknown; the sources do not name a fixed version","status":"open","published_at":"2026-11-04T08:17:16+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:32+00:00","updated_at":"2026-11-04T08:26:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T08:26:32Z","model":"claude-haiku-5-5","output":{"fix":"- WP Customer Area: unknown; the sources do not name a fixed version","reach":"internet","title":"WP Customer Area WordPress plugin: reflected XSS through version 8.4.1","impact":"medium","summary":"The WP Customer Area WordPress plugin does not neutralize input before writing it into a page, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-customer-area"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers, session cookies may be stolen","analyst_note":"Confirm the fixed version and the vulnerable parameter from the vendor or WPScan page; the NVD entry gives only the affected range.","how_to_check":"- Check whether the WP Customer Area plugin (customer-area) is installed on the WordPress site, in the plugins list or `wp plugin list`\n- Compare the installed version against the affected range, which runs through `8.4.1`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Customer Area plugin (customer-area) at version 8.4.1 or earlier, per the NVD description. The flaw is reflected, so exposure depends on the plugin reflecting unsanitized request input into pages. Sites without the plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4120,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-54861':13A,16A '8.4.1':10A,96C 'affect':89C 'aguila':77C 'allow':85C 'area':3A,22B,26B,81C,84C,92C 'attack':46B 'browser':54B 'craft':61B 'cross':42B,72C 'cross-sit':41B,71C 'custom':2A,21B,25B,80C,83C,91C 'customer-area':82C 'cve':11A,14A 'enabl':39B 'generat':70C 'improp':63C 'input':32B,66C 'issu':88C 'link':62B 'n/a':94C 'neutral':31B,64C 'open':59B 'packag':17B 'page':38B,69C 'plugin':5A,28B 'reflect':6A,40B,86C 'run':48B 'script':44B,49B,74C 'site':43B,73C 'technolog':78C 'trick':56B 'version':9A 'visitor':52B 'vulner':75C 'web':68C 'wordpress':4A,18B,27B 'wp':1A,20B,24B,79C,90C 'wp-customer-area':19B 'write':34B 'xss':7A 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area plugin (customer-area) at version 8.4.1 or earlier, per the NVD description. The flaw is reflected, so exposure depends on the plugin reflecting unsanitized request input into pages. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","wordpress","wpcustomerarea"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54861","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54861","severity":null,"published_at":"2026-11-04T08:17:16+00:00","modified_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}