CVE-2026-7640

Name of the Vulnerable Software and Affected Versions WP Customer Area versions prior to 8.3.6

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on the type attribute of the customer-area-protected-content shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update WP Customer Area to version 8.3.6 or later.