CVE-2026-7640

MediumCVSS 6.4/10Last modified Jul 15, 2026

Description

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-764005.9In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764015.9In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764028.2In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (R CVE-2026-764037.4In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant da CVE-2026-764049.1In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying o CVE-2026-764054.3In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could re CVE-2026-764065.9In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance CVE-2026-76407As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76408As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-764098.8As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a CVE-2026-76418.8The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0 CVE-2026-764128.5A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the