Junglewise Threat Intelligence

CVE-2026-15324: SysBasics Customize My Account for WooCommerce Stored XSS in row_type

CVE-2026-15324 · Severity: medium · CVSS 4.4 · Published 2026-07-16

Executive brief

A vulnerability exists in a popular WordPress plugin used to customize WooCommerce customer account pages. An attacker with administrative or shop manager privileges can inject malicious scripts into the website's settings. These scripts will then execute in the browsers of other users, potentially leading to unauthorized actions or data theft.

Technical details

The SysBasics Customize My Account for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'row_type' parameter. This vulnerability exists in versions up to and including 4.4.14. An authenticated attacker with high-level permissions (Shop Manager or higher) can inject arbitrary web scripts into the database. These scripts are then executed in the context of any user who visits the affected page, which could lead to session hijacking or further administrative compromise. The attack requires network access and high privileges, but the impact is elevated because the script can execute in the context of other users (Scope: Changed).

Affected products

  • SysBasics (phppoet) Customize My Account for WooCommerce – Live My Account Customizer up to, and including, 4.4.14

Timeline

  • 2026-07-16: disclosed
  • 2026-07-16: advisory

References