SysBasics Customize My Account for WooCommerce – Live My Account Customizer <= 4.3.9 - Reflected Cross-Site Scripting

This research plan outlines the analysis and verification of CVE-2026-57358, a reflected cross-site scripting (XSS) vulnerability in the SysBasics Customize My Account for WooCommerce plugin.

1. Vulnerability Summary

The vulnerability exists due to the improper neutralization of user-supplied input in the plugin's "Live Customizer" or "Admin Notice" features. Specifically, values from the $_GET global array are echoed back into the HTML response without adequate sanitization (e.g., sanitize_text_field()) or context-aware output escaping (e.g., esc_html() or esc_attr()). In versions up to 4.3.9, this allows an unauthenticated attacker to craft a URL that, when clicked by a logged-in administrator, executes arbitrary JavaScript in the context of the admin's session.

2. Attack Vector Analysis

• Vulnerable Endpoint: The WordPress admin dashboard, specifically pages where the plugin's customizer or notices are active (e.g., /wp-admin/admin.php?page=customize-my-account-for-woocommerce).
• Vulnerable Parameter: wcmam_message or custom_css_preview (inferred from plugin functionality).
• Authentication Requirement: Unauthenticated (attacker crafts the link), but requires a victim with administrative privileges to click the link to execute the script in a sensitive context.
• Context: The payload is reflected into the page body (within a notice div) or into a <style> block in the header.

3. Code Flow

The execution flow typically follows this path:

1. Entry Point: The plugin initializes via wcmamtx_Appsero\Client (as seen in Appsero/src/Client.php).
2. Hook Registration: The plugin or the integrated Appsero library (in Appsero/src/Insights.php) registers an admin_notices hook:

   add_action('admin_notices', [$this, 'admin_notice']);
   

3. Processing: The admin_notice() function (or a similar handler in the plugin core) checks for a "message" or "preview" parameter in the URL.
4. Sink: The parameter value is retrieved and echoed directly:

   // Inferred vulnerable pattern in the plugin core
   if (isset