CVE-2026-15324

Name of the Vulnerable Software and Affected Versions Customize My Account for WooCommerce – Live My Account Customizer versions prior to 4.4.15

Description Insufficient input sanitization and output escaping allow authenticated attackers with shop manager-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the row type parameter, which then execute when a user accesses the affected page.

Recommendations Update the plugin to version 4.4.15 or later. As a temporary mitigation, restrict access to the row type parameter for users with shop manager-level permissions.