Description
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
Published: 2026-10-30
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Cross Site Scripting in subscriber area
Action: Immediate Patch
AI Analysis

Impact

The plugin contains an XSS vulnerability in the subscriber area as identified by CWE‑79. The flaw allows injected script code to be rendered in the subscriber interface. It is inferred that the vulnerability may result from insufficient sanitization of subscriber input fields.

Affected Systems

Aguila Technologies WordPress WP Customer Area plugin versions 8.4.0 and earlier are affected. The vulnerability is present in all installations that use the plugin at or below this version threshold, regardless of the WordPress core version.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available. The CVE is not listed on the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Based on the description, it is inferred that attackers may target the plugin’s subscriber inputs to exploit the XSS flaw.

Generated by OpenCVE AI on October 30, 2026 at 19:54 UTC.

Remediation

Vendor Solution

Update to 8.4.1 or a higher version.

OpenCVE Recommended Actions

  • Upgrade the WP Customer Area plugin to version 8.4.1 or later, which removes the vulnerable code path and enforces proper output escaping.
  • After upgrading, delete any residual plugin files or backups that might still contain the insecure code to prevent accidental re‑introduction of the flaw.
  • Deploy a Web Application Firewall rule or apply a site‑wide input sanitization policy that blocks or escapes script tags in subscriber‑controlled fields to provide an additional layer of defense.

Generated by OpenCVE AI on October 30, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
Title WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-30T18:50:06.975Z

Reserved: 2026-10-27T00:20:51.129Z

Link: CVE-2026-116854

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-30T19:18:15.290

Modified: 2026-10-30T19:22:27.173

Link: CVE-2026-116854

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T20:00:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')