Description

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T12:17:17.177Z",
  "pubdate": "2026-11-06T12:17:17.177Z",
  "executiveSummary": "The WP Customer Area plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 8.4.0.\nThe vulnerability arises from improper sanitization and escaping of user-supplied data within the 'display_name' parameter.\nAn authenticated attacker with subscriber-level privileges or higher can inject malicious JavaScript payloads that persist within the application database.\nWhen a user or administrator navigates to a compromised page, the injected script executes within the context of their session, potentially leading to unauthorized actions, session hijacking, or credential theft.\nThe risk is categorized as high due to the potential for privilege escalation and unauthorized access to administrative or user accounts.\nSuccessful exploitation requires authenticated access, but no further special privileges are necessary to perform the attack.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), where the application fails to adequately sanitize the 'display_name' input field before storing it in the database and rendering it on the front-end or back-end dashboards.\nThe root cause is identified as an absence of robust input validation mechanisms and a failure to apply context-aware output encoding when displaying user-controlled metadata.\nThe attack vector involves a malicious actor submitting a crafted payload—such as <script>alert('XSS')</script>—into the 'display_name' parameter. Because the plugin does not properly neutralize these characters, the malicious string is committed to the database.\nOnce stored, the payload executes whenever the application reflects the 'display_name' parameter in a document object model (DOM) that is accessed by other users, including administrators.\nThe execution flow involves the following stages: 1) The attacker initiates an update to their profile or settings containing the payload. 2) The server processes the request and saves the unsanitized input to the database. 3) A target user visits the affected page where the plugin retrieves the malicious record. 4) The browser interprets the payload as legitimate script due to the lack of proper output escaping. 5) The script executes within the security context of the victim's browser session.\nThis vulnerability is particularly impactful because it allows for the exfiltration of sensitive session cookies, the performance of actions on behalf of the victim (CSRF-like behavior), or the redirection of users to malicious third-party domains.\nThe vulnerability affects all versions of the WP Customer Area plugin through 8.4.0. It requires a minimum of subscriber-level authentication, making it accessible to any registered user within the system, thereby significantly widening the attack surface for installations that allow open registration."
}