CVE-2026-12137: WooCommerce Customize My Account XSS Flaw

CVE-2026-12137 Overview

CVE-2026-12137 is a Reflected Cross-Site Scripting (XSS) vulnerability in the SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress. The flaw affects all versions up to and including 4.3.6. The vulnerability resides in the handling of the tab parameter, which lacks sufficient input sanitization and output escaping. Unauthenticated attackers can craft malicious links that inject arbitrary JavaScript into pages rendered by the plugin's plugin_options_page() function. Because that function executes only within the WordPress admin dashboard, exploitation requires a victim authenticated as Shop Manager or higher to click the crafted link.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browser of an authenticated Shop Manager or administrator, enabling session theft, privileged action abuse, and admin-context account takeover.

Affected Products

SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager (WordPress plugin)
All versions up to and including 4.3.6
WordPress sites running WooCommerce with the affected plugin enabled

Discovery Timeline

2026-06-18 - CVE-2026-12137 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-12137

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting issue classified under [CWE-79]. The plugin's admin settings handler reads the tab query string parameter and reflects the value directly into the rendered admin page without proper sanitization or output escaping. Attacker-supplied JavaScript is therefore returned in the HTTP response and executed by the victim's browser within the privileged WordPress admin origin.

Exploitation follows the standard reflected XSS chain. The attacker constructs a URL pointing to the plugin's options page with a malicious payload supplied via the tab parameter. The victim, while authenticated to WordPress, clicks the link, and the payload executes inside the admin dashboard context. From there, the script can issue authenticated requests, exfiltrate nonces and cookies, create new users, or modify store configuration.

Because the vulnerable plugin_options_page() function only renders inside wp-admin, the attack requires user interaction and an authenticated victim with Shop Manager-level capabilities or higher. The affected code paths are documented in the plugin source at include/admin/admin_settings.php lines 622 and 702.

Root Cause

The root cause is missing sanitization on input and missing escaping on output. The tab request parameter is consumed by plugin_options_page() and inserted into the HTML response without functions such as sanitize_text_field() on input or esc_attr()/esc_html() on output. Any character sequence supplied by the requester is rendered verbatim into the page markup.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL targeting the affected plugin's admin page with a malicious tab value containing JavaScript. The attacker delivers the URL through phishing, a forum post, a chat message, or a comment. When a logged-in Shop Manager or administrator clicks the link, the script executes in their session.

The vulnerability mechanism is described in prose only. See the WordPress Plugin Admin Settings Code and the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-12137

Indicators of Compromise

Requests to wp-admin URLs containing a tab parameter with HTML or JavaScript syntax such as <script>, onerror=, onload=, or javascript:.
Referrer headers pointing to external phishing domains immediately preceding admin sessions for Shop Manager or administrator accounts.
Unexpected creation of WordPress administrator users, new application passwords, or modified plugin settings shortly after a Shop Manager visit.

Detection Strategies

Inspect web server access logs for query strings on the plugin's options page containing URL-encoded angle brackets (%3C, %3E) or event handler keywords in the tab parameter.
Deploy Web Application Firewall (WAF) rules that block reflected XSS payloads on WordPress admin endpoints.
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution attempts in /wp-admin/.

Monitoring Recommendations

Alert on privileged WordPress role changes, plugin installs, and option updates correlated with recent admin session activity.
Track outbound HTTP requests from admin browsers to unfamiliar domains, which may indicate cookie or nonce exfiltration.
Centralize WordPress, WooCommerce, and web server logs in a SIEM and retain them long enough to investigate delayed exploitation.

How to Mitigate CVE-2026-12137

Immediate Actions Required

Update the SysBasics Customize My Account for WooCommerce plugin to a version newer than 4.3.6 as soon as a patched release is available.
Audit Shop Manager and administrator accounts, rotate passwords, and invalidate active sessions and application passwords.
Restrict access to /wp-admin/ by source IP where operationally feasible to reduce exposure to phishing-delivered links.

Patch Information

Review the plugin maintainer's release notes and the WordPress Plugin Changeset History for the corrective commit. Verify that patched code applies sanitize_text_field() to the tab input and esc_attr() or esc_html() on output before redeploying. Consult the Wordfence Vulnerability Report for vendor-tracked fix status.

Workarounds

Deactivate the SysBasics Customize My Account for WooCommerce plugin until a fixed version is installed.
Deploy a WAF rule that blocks requests to the plugin admin page where the tab parameter contains <, >, ", or ' characters.
Train Shop Manager and administrator users to avoid clicking links to /wp-admin/ URLs received from untrusted sources.

bash

# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate customize-my-account-for-woocommerce