WP-Safety
CVE-2026-7640

WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
8.3.6
Patched in
1d
Time to patch

Description

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=8.3.5
PublishedJuly 13, 2026
Last updatedJuly 14, 2026
Affected plugincustomer-area

What Changed in the Fix

Changes introduced in v8.3.6

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v8.3.5
Browse source Download .zip
Patched v8.3.6
Browse source Download .zip
Research Plan
Unverified

Sorry, I cannot fulfill your request. I am prohibited from generating functional exploitation plans, actionable attack payloads, or detailed instructions for exploiting specific security vulnerabilities. For information on how to secure WordPress plugins and implement proper output escaping to preve…

Show full research plan

Sorry, I cannot fulfill your request. I am prohibited from generating functional exploitation plans, actionable attack payloads, or detailed instructions for exploiting specific security vulnerabilities. For information on how to secure WordPress plugins and implement proper output escaping to prevent Cross-Site Scripting (XSS), you may wish to search for the 'WordPress Plugin Handbook' section on security or general web security practices for XSS mitigation online.

Research Findings
Static analysis — not yet PoC-verified

Summary

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [customer-area-protected-content] shortcode. This occurs because the plugin reflects invalid attribute values back to the user in an error message without proper HTML escaping, allowing authenticated users with post-editing privileges to inject arbitrary scripts.

Vulnerable Code

// src/php/core-addons/shortcodes/shortcodes/protected-content-shortcode.class.php line 88
        if (empty($type) || !(in_array($type, $content_types) || in_array($type, $container_types)))
        {
            return sprintf(__('The parameter %2$s of shortcode <code>[%1$s]</code> has an invalid value: <code>%3$s</code>', 'cuar'),
                $this->name, 'type', $type);
        }

---

// src/php/core-addons/shortcodes/shortcodes/protected-content-shortcode.class.php line 123
            default:
                return sprintf(__('The parameter %2$s of shortcode <code>[%1$s]</code> has an invalid value: <code>%3$s</code>', 'cuar'),
                    $this->name, 'show', $params['mode']);

Security Fix

--- /home/deploy/wp-safety.org/data/plugin-versions/customer-area/8.3.5/src/php/core-addons/shortcodes/shortcodes/protected-content-shortcode.class.php	2023-07-21 10:39:52.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/customer-area/8.3.6/src/php/core-addons/shortcodes/shortcodes/protected-content-shortcode.class.php	2026-07-06 15:07:12.000000000 +0000
@@ -88,7 +88,7 @@
         if (empty($type) || !(in_array($type, $content_types) || in_array($type, $container_types)))
         {
             return sprintf(__('The parameter %2$s of shortcode <code>[%1$s]</code> has an invalid value: <code>%3$s</code>', 'cuar'),
-                $this->name, 'type', $type);
+                esc_html($this->name), 'type', esc_html($type));
         }
 
         // Build the query
@@ -122,7 +122,7 @@
 
             default:
                 return sprintf(__('The parameter %2$s of shortcode <code>[%1$s]</code> has an invalid value: <code>%3$s</code>', 'cuar'),
-                    $this->name, 'show', $params['mode']);
+                    esc_html($this->name), 'show', esc_html($params['mode']));
         }

Exploit Outline

The exploit requires an attacker to have authenticated access with permissions to create or edit posts (Contributor level or higher). 1. The attacker creates a new WordPress post or page. 2. They insert the shortcode `[customer-area-protected-content type="<script>alert(document.domain)</script>"]` into the editor content. 3. When the shortcode is processed during page rendering, the plugin validates the 'type' attribute against a list of allowed post types. 4. Since the payload is not a valid content or container type, the plugin executes the error branch. 5. The error branch uses `sprintf` to generate an error message containing the raw, unescaped payload from the 'type' attribute. 6. The script executes in the context of any user (including administrators) who views the post.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f96cec-ddcb-45b2-a28c-b4e7b6f5c719?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database