{"id":"CVE-2026-57666","kind":"vulnerability","aliases":["CVE-2026-57666"],"related":[],"title":"WP Customer Area WordPress plugin: reflected XSS through version 8.4.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.","summary":"The WP Customer Area WordPress plugin by Aguila Technologies does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run scripts in a visitor's browser by getting them to open a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["customer-area","package","wordpress","wp-customer-area"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress site runs the `customer-area` plugin (WP Customer Area) in the plugin list or `wp plugin list`\n- Compare the installed plugin version against `8.4.1`; versions up to and including `8.4.1` are listed as affected","fix":"- WP Customer Area: unknown (the sources do not name a fixed version)","status":"open","published_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:28+00:00","updated_at":"2026-11-04T08:26:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T08:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- WP Customer Area: unknown (the sources do not name a fixed version)","reach":"internet","title":"WP Customer Area WordPress plugin: reflected XSS through version 8.4.1","impact":"medium","summary":"The WP Customer Area WordPress plugin by Aguila Technologies does not neutralize input in some pages, allowing reflected cross-site scripting. An attacker can run scripts in a visitor's browser by getting them to open a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-customer-area","customer-area"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in a victim's browser session on the site","analyst_note":"Confirm the fixed version and the affected page or parameter from the vendor advisory or the NVD entry.","how_to_check":"- Check whether the WordPress site runs the `customer-area` plugin (WP Customer Area) in the plugin list or `wp plugin list`\n- Compare the installed plugin version against `8.4.1`; versions up to and including `8.4.1` are listed as affected\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Customer Area plugin (customer-area) at version 8.4.1 or earlier are exposed. The flaw is a reflected XSS, so it matters most where customers log in to the site and could be sent a crafted link. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4120,"output_tokens":581,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57666':13A,16A '8.4.1':10A,99C 'affect':92C 'aguila':33B,80C 'allow':42B,88C 'area':3A,19B,25B,29B,84C,87C,95C 'attack':49B 'browser':57B 'craft':64B 'cross':45B,75C 'cross-sit':44B,74C 'custom':2A,18B,24B,28B,83C,86C,94C 'customer-area':17B,85C 'cve':11A,14A 'generat':73C 'get':59B 'improp':66C 'input':38B,69C 'issu':91C 'link':65B 'n/a':97C 'neutral':37B,67C 'open':62B 'packag':20B 'page':41B,72C 'plugin':5A,31B 'reflect':6A,43B,89C 'run':51B 'script':47B,52B,77C 'site':46B,76C 'technolog':34B,81C 'version':9A 'visitor':55B 'vulner':78C 'web':71C 'wordpress':4A,21B,30B 'wp':1A,23B,27B,82C,93C 'wp-customer-area':22B 'xss':7A 'xss.this':90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Customer Area plugin (customer-area) at version 8.4.1 or earlier are exposed. The flaw is a reflected XSS, so it matters most where customers log in to the site and could be sent a crafted link. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["customerarea","high","package","wordpress","wpcustomerarea"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57666","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57666","severity":null,"published_at":"2026-11-04T08:17:17+00:00","modified_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}