The vulnerability is an improper neutralization of input during web page generation, allowing a reflected XSS attack. A malicious actor can craft input that is reflected in the page without proper encoding, enabling the execution of arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, credential theft, defacement, or the installation of malware on the client side. The weakness is identified as CWE‑79.

The affected product is the WordPress WP Customer Area plugin by Aguila Technologies. Versions from the earliest available release up through 8.4.1 are vulnerable, meaning any installation of the plugin that has not been upgraded to at least 8.4.2 is at risk.

With a CVSS score of 7.1 the vulnerability carries a high risk rating. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known mass exploitation campaigns yet. However, the attack vector is remote: a user can trigger the exploit by accessing a crafted URL or injecting payload into a form that is reflected back. Because the flaw is a classic reflected XSS, exploitation requires only that the attacker get a victim to visit the malicious link, which is a relatively low barrier to entry for attackers. The lack of special conditions or privilege escalation limits the scope to the victim’s browser, but the impact on confidentiality and integrity of sensitive data remains significant.