This vulnerability arises from improper neutralization of user input during page generation by the WP Customer Area plugin. It allows attacker‑supplied scripts to be stored and later executed in the browsers of users who view the affected content, potentially enabling session hijacking, defacement, or data theft. The weakness is classified as Stored Cross‑Site Scripting (CWE‑79).

Aguila Technologies WP Customer Area for WordPress versions from the initial release up to and including 8.4.3 are affected. The patch version 8.4.4 or later resolves the issue.

The CVSS score is 6.5, indicating a moderate risk level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can submit data to the plugin—such as an admin or a user with content‑creation privileges—could store malicious scripts that get later rendered in other users’ browsers.