Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Vendor: aguilatechnologies Clear all filters
TI-2026-86518 CVE-2026-120365 · GHSA-mqw9-hmwg-5jgm

Stored cross-site scripting in WordPress WP Customer Area plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a thr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0017 Published 2026-11-07 No fix listed CWE-79
TI-2026-85890 CVE-2026-116551 · GHSA-hcq2-mw85-wh93

Stored cross-site scripting in WP Customer Area WordPress plugin

Priority LOW 28

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00294 Published 2026-11-06 No fix listed CWE-79
TI-2026-84982 CVE-2026-57666 · GHSA-hfp9-jwcf-cfg7

Reflected XSS in WordPress WP Customer Area plugin

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-11-04 No fix listed CWE-79
TI-2026-84979 CVE-2026-54861 · GHSA-h4pw-ggq7-3wp8

Reflected cross-site scripting in WP Customer Area WordPress plugin

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00146 Published 2026-11-04 No fix listed CWE-79
TI-2026-06722 CVE-2026-7640 · GHSA-prrr-x57g-5wrp

WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Priority LOW 28

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-14 No fix listed CWE-79
TI-2026-02984 CVE-2026-3464 · GHSA-9859-fqhx-279v

WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file

Priority MEDIUM 42

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00968 Published 2026-04-17 No fix listed CWE-22
TI-2025-37567 CVE-2025-60201 · GHSA-h6c4-8h46-gcfm

WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerability

Priority LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00461 Published 2025-11-06 Fixed in 8.3.4 CWE-98
TI-2025-31897 CVE-2025-49982 · GHSA-w8c6-jhx2-568h

WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability

Priority LOW 20

Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00267 Published 2025-06-20 No fix listed CWE-862