CVE-2026-116854
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
Risk Assessment
An attacker with a subscriber account can inject malicious script that executes in other users' browsers, including administrators.
Recommendation
Update the WP Customer Area plugin to a version newer than 8.4.0 and limit subscriber roles to necessary permissions.
Other vulnerabilities in WP Customer Area
See all- CVE-2026-7640Medium
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute.
- CVE-2026-42661High
The WP Customer Area plugin versions up to 8.3.4 contain a Path Traversal vulnerability, which may allow unauthorized access to system files.
- CVE-2025-60201High
The WordPress plugin WP Customer Area before version 8.3.4 contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename for include/require statement. This allows an attacker to include local PHP files.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS