Executive brief
The Customize My Account For Woocommerce plugin for WordPress is vulnerable to a security flaw that allows users with basic contributor permissions to inject malicious scripts into website pages. This plugin is used to manage customer account dashboards and avatars on e-commerce sites. If exploited, an attacker could execute code in the browsers of other users or administrators, potentially leading to unauthorized actions or data theft.
Technical details
The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the wcmamtx_get_avatar_default() function. Specifically, user-supplied attributes such as 'min_height', 'min_width', 'max_height', and 'max_width' within the 'sysbasics_user_avatar' shortcode are concatenated unescaped into the 'get_avatar()' extra_attr style attribute. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts are stored on the server and execute in the context of any user who views the affected page. The vulnerability exists in all versions up to and including 4.3.6.
Affected products
- phppoet Customize My Account For Woocommerce up to, and including, 4.3.6
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/customize-my-account-for-woocommerce/tags/4.3.6/include/sysbasics-avatar-upload.php
- https://plugins.trac.wordpress.org/browser/customize-my-account-for-woocommerce/tags/4.3.6/include/sysbasics-avatar-upload.php
- https://plugins.trac.wordpress.org/browser/customize-my-account-for-woocommerce/tags/4.3.6/include/wcmamtx_extra_functions.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3571110%40customize-my-account-for-woocommerce&new=3571110%40customize-my-account-for-woocommerce&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/44d041ca-caa6-410d-b2d1-7a63208cc512?source=cve