CVE-2026-57358

The Customize My Account for WooCommerce plugin version 4.3.9 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The risk includes session hijacking, credential theft, or redirection to malicious sites. The attack does not require authentication, increasing its reach.

Immediately update the plugin to the latest available version. Consider deploying a Web Application Firewall (WAF) to block script injection attempts.