The Customize My Account for WooCommerce plugin permits stored cross‑site scripting via the sysbasics_user_avatar shortcode attributes min_height, min_width, max_height, and max_width. Because these values are concatenated unescaped into the style attribute of get_avatar(), an attacker can inject arbitrary JavaScript. The injected payload is saved in the database and will execute in the browsers of any user who views a page containing the shortcode, allowing the attacker to run code in the context of the site.

This flaw exists in the phppoet:SysBasics Customize My Account for WooCommerce plugin for WordPress. All releases up to and including version 4.3.6 are vulnerable. The plugin is commonly used on e‑commerce sites that require custom account pages, dashboards, or avatar management and operates within the WordPress environment.

The CVSS score of 6.4 indicates a moderate severity risk. The EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. However, the vulnerability requires an authenticated user with Contributor level or higher. An attacker can execute scripts by adding malicious attributes to the shortcode, which will run in any visitor’s browser when the page is rendered.