CVE-2026-120365

MediumCVSS 6.5/10Last modified Nov 7, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Aguila Technologies	WP Customer Area	<= 8.4.3

References

https://patchstack.com/database/wordpress/plugin/customer-area/vulnerability/wordpress-wp-customer-area-plugin-8-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Nov 7, 2026
Last modified: Nov 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1203677.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Mosh CVE-2026-120375.5The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including CVE-2026-1203865.1Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced CVE-2026-120395.7Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to DNS resolution: the per-network embedded DNS server CVE-2026-1203997.5A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadlin CVE-2026-1204074.5The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from,CVE-2026-1204088.0The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin CVE-2026-1204095.3The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through i CVE-2026-120414.4The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all vers CVE-2026-1204155.9undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive h CVE-2026-1204165.3A security vulnerability has been detected in AndyFactory newspaper4k up to 0.9.6. This affects the function Article.parse of the file newsp CVE-2026-120424.4The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and i