CVE-2026-12136: Stored XSS in Customize My Account For Woocommerce Plugin

Technical summary

CVE-2026-12136 is a Stored XSS vulnerability in the Customize My Account For Woocommerce plugin (versions up to 4.3.6) stemming from inadequate input sanitization in the sysbasics_user_avatar shortcode. The wcmamtx_get_avatar_default() function accepts four unvalidated attributes—min_height, min_width, max_height, and max_width—which are concatenated directly into the style attribute parameter passed to the WordPress get_avatar() function. Because these values are not escaped before insertion, an attacker can inject arbitrary CSS or HTML/JavaScript payloads. The vulnerability requires authentication at Contributor level or higher, meaning the attacker must have legitimate user account access. Since the payload is stored in the page content itself, it persists and executes for all subsequent visitors.

Business impact

For WordPress site operators running this plugin, the primary business risks are brand reputation damage from defaced or compromised pages, potential loss of customer trust if user data is exfiltrated via injected scripts, and operational disruption from incident response activities. Multisite WordPress installations and communities that allow user-generated content (via Contributors) face elevated exposure. The vulnerability does not directly compromise site confidentiality or availability in the CVSS sense, but the ability to execute JavaScript on behalf of visitors creates indirect risks: attackers could redirect users to malicious sites, capture form submissions, or escalate privileges by exploiting higher-level user sessions.

Affected systems

The Customize My Account For Woocommerce plugin in all versions through 4.3.6 is affected. This applies to any WordPress installation using this plugin where the sysbasics_user_avatar shortcode is enabled or used in page content. Risk is elevated in environments where Contributor-level accounts are distributed to external users, content creators, or untrusted team members. Self-hosted WordPress sites are the primary exposure vector; managed WordPress hosting platforms may have additional mitigations in place.

Exploitability

Exploitation requires valid WordPress user credentials at Contributor level or above. An attacker cannot exploit this remotely without authentication, which limits the threat actor pool. However, in organizations where content creation roles are widely distributed, or where accounts may be compromised separately, this becomes a realistic attack path. Once authenticated, the technical bar for crafting the malicious payload is very low—basic HTML/JavaScript knowledge suffices. The payload execution is automatic and does not require user interaction beyond visiting an affected page, making it reliably exploitable once injected.

Remediation

Update the Customize My Account For Woocommerce plugin to a version newer than 4.3.6 that addresses the input sanitization and output escaping issues. Organizations should verify the exact patched version against the vendor advisory. As an interim measure, restrict Contributor-level permissions to trusted users only, review recent post and page history for suspicious shortcode usage, and audit user account access logs for unauthorized activity. If the plugin cannot be updated immediately, consider disabling the sysbasics_user_avatar shortcode if it is not essential to site functionality.

Patch guidance

Verify the latest available version of Customize My Account For Woocommerce through the official WordPress plugin repository or the vendor's website. Update via the WordPress admin dashboard (Plugins > Updates) once a patched version is confirmed available. Before deploying to production, test the update on a staging environment to ensure compatibility with other active plugins and customizations. Document the update in your change log. If a patched version is not yet available, monitor the vendor's security advisories for release announcements.

Detection guidance

Search page and post content in your WordPress database for instances of the sysbasics_user_avatar shortcode, particularly with min_height, min_width, max_height, or max_width attributes containing unusual or encoded values. Review WordPress user audit logs for post/page modifications by Contributor-level accounts, paying attention to creation or modification timestamps that correlate with suspicious activity. Monitor site analytics for unexpected traffic patterns or user complaints of redirects. If you operate a Web Application Firewall (WAF), consider creating rules to flag suspicious style attribute injection patterns in shortcode parameters.

Why prioritize this

Although the CVSS score of 6.4 (Medium) does not suggest critical urgency, the confluence of factors warrants prompt attention: the vulnerability is stored (persistent), requires no user interaction to trigger, and can enable account takeover or credential theft via JavaScript execution. The requirement for Contributor-level authentication is a significant limiting factor, but in many WordPress environments, that role is assigned liberally. The lack of CISA KEV listing means exploitation in the wild is not yet documented at scale, providing a window to patch before threat actor tooling matures. Organizations should prioritize this based on the number of Contributor accounts in their environment and the sensitivity of content served by their WordPress installation.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a Medium-severity vulnerability with network-accessible attack vector, low attack complexity, and requirement for low-level privileges (Contributor role). The impact is limited to confidentiality and integrity (hence the C:L and I:L values); availability is not affected. The 'S:C' (Scope Changed) designation indicates that the vulnerable component (the plugin) can affect the security of resources beyond its own scope (other users' browsers). The score would be higher (7.0+) if no authentication were required, or lower if privilege escalation and persistence were more difficult to achieve.

Frequently asked questions