CVE-2026-57666 · Package
NO FIX YET · SEE WHAT TO DO
The WP Customer Area WordPress plugin by Aguila Technologies does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run scripts in a visitor's browser by getting them to open a crafted link.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WP Customer Area plugin (customer-area) at version 8.4.1 or earlier are exposed. The flaw is a reflected XSS, so it matters most where customers log in to the site and could be sent a crafted link. Sites that do not run this plugin can skip it.
Not affected if plugin-not-installed
Who cares customer-area, wordpress, wp-customer-area
customer-area plugin (WP Customer Area) in the plugin list or wp plugin list8.4.1; versions up to and including 8.4.1 are listed as affectedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-57666") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.