The vulnerability is an Improper Neutralization of Input During Web Page Generation that allows reflected Cross‑Site Scripting. An attacker can inject malicious scripts into the output of the WordPress WP Customer Area plugin, enabling the execution of arbitrary JavaScript in a victim’s browser. Potential outcomes include session hijacking, defacement, or theft of sensitive data from authenticated users. The flaw can affect any user who can interact with plugin interfaces that reflect user‑supplied input.

The flaw exists in the Aguila Technologies WP Customer Area plugin for WordPress, affecting all releases up to and including version 8.4.1.

With a CVSS score of 7.1 the vulnerability is considered High. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS, whereby an attacker crafts input—such as a URL or form field—that is echoed back to the user without proper sanitization. Successful exploitation would allow the attacker to execute arbitrary code in the context of the vulnerable site.