An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the SysBasics Customize My Account for WooCommerce plugin versions 4.3.9 and earlier. The flaw is identified as CWE‑79 and allows arbitrary scripts to be executed in the victim’s browser.

The SysBasics Customize My Account for WooCommerce WordPress plugin version 4.3.9 and earlier. Sites running any of these versions are at risk; administrators should verify the plugin version and upgrade to avoid exploitation.

Based on the description, it is inferred that a crafted URL including the vulnerable parameter can be delivered to the victim’s browser. The CVSS score indicates medium‑to‑high severity, and the low EPSS score (<1%) suggests limited exploitation activity, although the vulnerability is not listed in the KEV catalog. The injected script executes with the victim’s browser rights, posing a risk to user data and site integrity. Based on the description, it is inferred that no authentication or privileged access is required.