Plugin icon

WP Customer Area

customer-area

Vulnerabilities:

11

Last Updated:

April 16, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-05-01
Title
WP Customer Area < 8.3.5 - Authenticated (Custom+) Path Traversal
Fixed in
Fixed in 8.3.5
CVSS
5.3 (medium)
Published
2026-04-17
Title
WP Customer Area < 8.3.5 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file
Fixed in
Fixed in 8.3.5
CVSS
8.8 (high)
Published
2025-07-21
Title
Customer Area <= 8.2.7 - Unauthenticated Local File Inclusion
Fixed in
No known fix
CVSS
8.1 (high)
Published
2025-06-19
Title
WP Customer Area <= 8.3.4 - Missing Authorization
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Bulk Delete via CSRF
Fixed in
Fixed in 8.2.5
CVSS
4.3 (medium)
Published
2025-01-06
Title
WP Customer Area < 8.2.5 - Event Log Deletion via CSRF
Fixed in
Fixed in 8.2.5
CVSS
4.3 (medium)
Published
2024-01-23
Title
WP Customer Area < 8.2.3 - Reflected Cross-Site Scripting
Fixed in
Fixed in 8.2.3
CVSS
6.1 (medium)
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Update
Fixed in
Fixed in 8.2.1
CVSS
4.3 (medium)
Published
2024-01-10
Title
WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak
Fixed in
Fixed in 8.2.1
CVSS
4.3 (medium)
Published
2023-01-17
Title
WP Customer Area < 8.1.4 - Unauthorised Actions via CSRF
Fixed in
Fixed in 8.1.4
CVSS
6.1 (medium)
Published
2017-11-22
Title
Customer Area < 7.4.3 - XSS
Fixed in
Fixed in 7.4.3
CVSS
6.1 (medium)