CVE-2026-57358: Unauthenticated XSS in Customize My Account for WooCommerce ≤4.3.9

Technical summary

CVE-2026-57358 is an unauthenticated reflected XSS vulnerability (CWE-79) in the Customize My Account for WooCommerce plugin affecting version 4.3.9 and below. The vulnerability stems from insufficient input validation and output encoding in the plugin's handling of user-supplied data. Because the plugin does not properly escape or sanitize untrusted input before rendering it in HTML context, an attacker can craft a specially formatted URL or form submission that causes arbitrary JavaScript to execute within the victim's browser session. The attack vector is network-based with low complexity, requires no privileges, but does necessitate user interaction (clicking a link). With a CVSS score of 7.1 (HIGH), the impact spans confidentiality, integrity, and availability within the context of the affected browser session and site.

Business impact

For WooCommerce store operators, this vulnerability can lead to customer account compromise, credential theft, and unauthorized transactions. An attacker could redirect customers to phishing pages, steal authentication tokens, or modify account details (addresses, payment methods) without the store operator's knowledge. The reputational damage from customer data exposure or fraudulent activity conducted through compromised accounts can erode trust and result in chargebacks. Additionally, if the XSS is chained with other vectors, it could facilitate more sophisticated attacks such as supply chain compromises or widespread malware distribution via the store.

Affected systems

The Customize My Account for WooCommerce plugin versions 4.3.9 and earlier are affected. Any WooCommerce installation running this plugin at or below the affected version is at risk. The vulnerability does not require the attacker to have administrative access to the store; it is exploitable by unauthenticated actors via crafted URLs or injected content. Patched versions above 4.3.9 are not affected; store operators should verify their installed version against the plugin repository or their update notifications.

Exploitability

This vulnerability is relatively straightforward to exploit due to its low attack complexity and lack of authentication requirements. An attacker can distribute a malicious link via email, social media, forums, or comment sections on the store itself. When a customer clicks the link, the XSS payload executes immediately in their browser with their current session privileges. No advanced techniques are needed; basic URL encoding and JavaScript payloads suffice. However, exploitation requires the victim to interact with the malicious link, which lowers the attack surface compared to fully unauthenticated remote code execution but remains a practical threat in targeted or mass-phishing scenarios.

Remediation

Store operators must immediately upgrade Customize My Account for WooCommerce to a version newer than 4.3.9. The plugin should be updated through the WordPress admin dashboard or manually via the plugin repository. After patching, verify that the plugin version number reflects the update and test critical customer-facing workflows to ensure compatibility. As an interim measure while planning the upgrade, administrators should review access logs for suspicious query strings or unexpected parameter usage that might indicate exploitation attempts.

Patch guidance

Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Customize My Account for WooCommerce, and check the current version. If it shows 4.3.9 or lower, click the update button if available, or manually download the latest version from the WordPress plugin repository. After updating, verify the new version number in the plugin list and perform a quick functional test of customer account pages. If automatic updates are disabled, prioritize this plugin in your update queue. For stores with custom modifications to the plugin, consult your developer before upgrading to ensure compatibility.

Detection guidance

Monitor web server logs and WAF (Web Application Firewall) logs for unusual query strings or POST parameters containing JavaScript syntax (e.g., <script>, onerror=, onload=, javascript:). Watch for patterns matching common XSS payloads such as event handlers or HTML tags in plugin-specific parameter names. Check access logs for repeated failed attempts to reach plugin endpoints with suspicious input. If you lack WAF capabilities, review HTTP requests to pages served by the Customize My Account plugin for unexpected HTML entities, script tags, or encoded JavaScript. Customer reports of unexpected redirects or altered account pages can also signal active exploitation.

Why prioritize this

With a CVSS score of 7.1 and direct impact on customer trust and transaction security, this vulnerability should be prioritized for immediate patching. Although the KEV program has not yet flagged it, the low barrier to exploitation and high business impact on e-commerce operations warrant urgent action. Any WooCommerce store using this plugin should treat it as a critical update candidate, especially those processing sensitive customer data or high transaction volumes.

Risk score, explained

The CVSS 7.1 (HIGH) score reflects the combination of an unauthenticated attack vector (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and required user interaction (UI:R). The scope is changed (S:C), meaning the impact affects resources beyond the vulnerable component (other users' sessions, store reputation). The confidentiality, integrity, and availability impacts are all rated low (C:L, I:L, A:L) per the CVSS model because the attacker can typically affect one user per attack and the impact is limited to that session context, not the entire system. However, in aggregate across many customers, the business risk is substantial.

Frequently asked questions