The flaw allows an attacker to persistently store malicious JavaScript within the WP Customer Area plugin. When other users view content that includes this script, it executes in their browsers, potentially leading to cookie theft, session hijacking, or defacement—these effects are inferred from the vulnerability type, as the description does not specify them directly.

WordPress sites that have installed the WP Customer Area plugin by Aguila Technologies version 8.4.3 or earlier are vulnerable. Any site configuration that permits users to submit and store content that the plugin outputs falls within the impact range.

The CVSS base score of 6.5 indicates moderate severity. The vulnerability is a stored client‑side flaw that can be exploited remotely when a user can submit crafted input to the plugin. No EPSS score is available and the issue is not listed in the CISA KEV catalog. An attacker who can create or edit content within the plugin can inject scripts that will run in the browsers of all visitors who view the affected pages.