Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 253,029 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · customer-area
customer-area
12 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 13, 2026WP Customer Area: Stored Cross-Site ScriptingCVE-2026-7640 · affects up to 8.3.5 · reported by WordfenceMedium 6.4
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.CVE-2026-42661 · affects up to 8.3.4 · reported by PatchstackHigh 8.8
Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.
Apr 17, 2026WP Customer Area: Arbitrary file read and deletionCVE-2026-3464 · affects up to 8.3.4 · reported by WordfenceHigh 8.8
The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g., Subscriber) to to read the contents of arbitrary files on the server, which can contain sensitive information, or delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025aguilatechnologies WP Customer Area customer-area: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60201 · fixed in 8.3.4 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion. This issue affects WP Customer Area: before 8.3.4.
Jun 20, 2025WP Customer Area: Missing AuthorizationCVE-2025-49982 · affects up to 8.3.4 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
Jan 27, 2025WP Customer Area: Does not have CSRF checks in some placesCVE-2024-12436 · affects up to 8.2.4 · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Jan 27, 2025WP Customer Area: Does not have CSRF check in placeCVE-2024-12280 · affects up to 8.2.4 · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack
Jan 24, 2024WP Customer Area: Reflected Cross-Site ScriptingCVE-2024-0665 · affects up to 8.2.1 · reported by WordfenceMedium 6.1
The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2024WP Customer Area: Does not properly validates user capabilities in some of its AJAX actionsCVE-2023-6824 · fixed in 8.2.1 · reported by WPScanMedium 6.5
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
Jan 16, 2024WP Customer Area: Does not properly validate users capabilities in some of its AJAX actionsCVE-2023-6741 · fixed in 8.2.1 · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
Feb 13, 2023WP Customer Area: Does not have CSRF checksCVE-2022-4745 · fixed in 8.1.4 · reported by WPScanHigh 7.1
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
Aug 20, 2019The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.CVE-2017-18519 · fixed in 7.4.3 · reported by MITREMedium 6.1
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.