[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5EqhqQzOxY4e-XGfi6nn2M4C2lkvQjah1vXhP5ra6JM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-57358","sysbasics-customize-my-account-for-woocommerce-live-my-account-customizer-reflected-cross-site-scripting","SysBasics Customize My Account for WooCommerce – Live My Account Customizer \u003C= 4.3.9 - Reflected Cross-Site Scripting","The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","customize-my-account-for-woocommerce",null,"\u003C=4.3.9","4.3.10","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 20:00:31",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F52ff0d94-82cc-4ebd-9481-6d29f00fcc02?source=api-prod",7,[22,23,24,25,26,27,28,29],"Appsero\u002F.editorconfig","Appsero\u002F.php-cs-fixer.dist.php","Appsero\u002Fcomposer.json","Appsero\u002Fcomposer.lock","Appsero\u002Fphpcs.xml.dist","Appsero\u002Freadme.md","Appsero\u002Fsrc\u002FClient.php","Appsero\u002Fsrc\u002FInsights.php","researched",false,3,"This research plan outlines the analysis and verification of **CVE-2026-57358**, a reflected cross-site scripting (XSS) vulnerability in the **SysBasics Customize My Account for WooCommerce** plugin.\n\n### 1. Vulnerability Summary\nThe vulnerability exists due to the improper neutralization of user-supplied input in the plugin's \"Live Customizer\" or \"Admin Notice\" features. Specifically, values from the `$_GET` global array are echoed back into the HTML response without adequate sanitization (e.g., `sanitize_text_field()`) or context-aware output escaping (e.g., `esc_html()` or `esc_attr()`). In versions up to **4.3.9**, this allows an unauthenticated attacker to craft a URL that, when clicked by a logged-in administrator, executes arbitrary JavaScript in the context of the admin's session.\n\n### 2. Attack Vector Analysis\n*   **Vulnerable Endpoint**: The WordPress admin dashboard, specifically pages where the plugin's customizer or notices are active (e.g., `\u002Fwp-admin\u002Fadmin.php?page=customize-my-account-for-woocommerce`).\n*   **Vulnerable Parameter**: `wcmam_message` or `custom_css_preview` (inferred from plugin functionality).\n*   **Authentication Requirement**: Unauthenticated (attacker crafts the link), but requires a victim with administrative privileges to click the link to execute the script in a sensitive context.\n*   **Context**: The payload is reflected into the page body (within a notice `div`) or into a `\u003Cstyle>` block in the header.\n\n### 3. Code Flow\nThe execution flow typically follows this path:\n1.  **Entry Point**: The plugin initializes via `wcmamtx_Appsero\\Client` (as seen in `Appsero\u002Fsrc\u002FClient.php`).\n2.  **Hook Registration**: The plugin or the integrated Appsero library (in `Appsero\u002Fsrc\u002FInsights.php`) registers an `admin_notices` hook:\n    ```php\n    add_action('admin_notices', [$this, 'admin_notice']);\n    ```\n3.  **Processing**: The `admin_notice()` function (or a similar handler in the plugin core) checks for a \"message\" or \"preview\" parameter in the URL.\n4.  **Sink**: The parameter value is retrieved and echoed directly:\n    ```php\n    \u002F\u002F Inferred vulnerable pattern in the plugin core\n    if (isset","gemini-3-flash-preview","2026-07-25 11:59:24","2026-07-25 12:01:07",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.3.9","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomize-my-account-for-woocommerce\u002Ftags\u002F4.3.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustomize-my-account-for-woocommerce.4.3.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomize-my-account-for-woocommerce\u002Ftags\u002F4.3.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustomize-my-account-for-woocommerce.4.3.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustomize-my-account-for-woocommerce\u002Ftags"]