Stored Cross-Site Scripting Vulnerability in SysBasics Customize My Account for WooCommerce Plugin
CVE-2026-15324

4.4MEDIUM

Key Information:

Vendor

WordPress
Status
Sysbasics Customize My Account For WooCommerce – Live My Account Customizer
Vendor
CVE Published:
16 July 2026

What is CVE-2026-15324?

The SysBasics Customize My Account for WooCommerce plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability through the 'row_type' parameter. This issue arises from inadequate input sanitization and output escaping, enabling authenticated users with shop manager-level access or higher to inject arbitrary scripts. These malicious scripts execute whenever a user interacts with the compromised pages, posing a risk to site security and user data integrity.

Affected Version(s)

SysBasics Customize My Account for WooCommerce – Live My Account Customizer 0 <= 4.4.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/customize-my-a...
https://plugins.trac.wordpress.org/browser/customize-my-a...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PRISM
.