The WP Customer Area plugin permits authenticated users with Contributor privileges or higher to embed content via the customer‑area‑protected‑content shortcode. The 'type' attribute of this shortcode is not properly sanitized or escaped, enabling attackers to store arbitrary JavaScript. When a protected page is viewed, the stored script executes in the victim’s browser, providing client‑side code execution that can lead to session hijacking, defacement, or theft of sensitive information. This flaw is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79).

WP Customer Area versions up to and including 8.3.5, distributed by Aguilate Technologies, are affected. Any WordPress site running one of those releases must consider the flaw, as Contributor or higher accounts can inject scripts into any protected page accessible to other users.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires the attacker to authenticate with Contributor‑level or higher access to inject the payload, after which any user who views the affected page will receive the malicious script. Because the attack vector is authenticated, the risk to unauthenticated visitors is limited, but compromised contributors pose a significant threat.