Plugin security history

WP Customer Area Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with WP Customer Area, published between 2017 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

12Total records

0Critical

3High

9Medium

0Low

0Informational

11Patched records

1Currently marked unpatched

2017-11-22First disclosure

2026-07-13Latest disclosure

12 of 12CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2017	1	1 records
2023	1	1 records
2024	3	3 records
2025	4	4 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
High	3	25%
Medium	9	75%

Vulnerability-Type Breakdown

Cross-Site Scripting

3 records25%

First: 2017. Latest: 2026.

CSRF

3 records25%

First: 2023. Latest: 2025.

Missing Authorization

3 records25%

First: 2024. Latest: 2025.

Path Traversal

2 records16.7%

First: 2026. Latest: 2026.

Other

1 record8.3%

First: 2025. Latest: 2025.

Patch Status

Patched: 11
Currently marked unpatched: 1
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

8.3.6
8.3.5
8.3.4
8.2.5
8.2.3
8.2.1
8.1.4
7.4.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-8.3.5`	WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute	July 13, 2026	8.3.6	Medium
`*-8.3.4`	WP Customer Area <= 8.3.4 - Authenticated (Custom+) Path Traversal	May 1, 2026	8.3.5	Medium
`*-8.3.4`	WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file	April 17, 2026	8.3.5	High
`[*, 8.3.4)`	Customer Area < 8.3.4 - Unauthenticated Local File Inclusion	July 21, 2025	8.3.4	High
`*-8.2.5`	WP Customer Area <= 8.2.5 - Missing Authorization	June 19, 2025	Not supplied	Medium
`*-8.2.4`	WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Bulk Deletion	January 6, 2025	8.2.5	Medium
`*-8.2.4`	WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion	January 6, 2025	8.2.5	Medium
`*-8.2.2`	WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting	January 23, 2024	8.2.3	Medium
`*-8.2.0`	WP Customer Area <= 8.2.0 - Insecure Direct Object Reference to Account Address Disclosure	January 10, 2024	8.2.1	Medium
`*-8.2.0`	WP Customer Area <= 8.2.1 - Insecure Direct Object Reference to Address Modification	January 10, 2024	8.2.1	Medium
`*-8.1.3`	WP Customer Area <= 8.1.3 - Cross-Site Request Forgery	January 17, 2023	8.1.4	High
`[*, 7.4.3)`	WP Customer Area <= 7.4.2 - Cross-Site Scripting	November 22, 2017	7.4.3	Medium

Selected source records

Latest Records

MediumCVE-2026-7640

WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Published: July 13, 2026

Affected versions: *-8.3.5
Patched versions: 8.3.6

Original Wordfence record

MediumCVE-2026-42661

WP Customer Area <= 8.3.4 - Authenticated (Custom+) Path Traversal

Published: May 1, 2026

Affected versions: *-8.3.4
Patched versions: 8.3.5

Original Wordfence record

HighCVE-2026-3464

WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file

Published: April 17, 2026

Affected versions: *-8.3.4
Patched versions: 8.3.5

Original Wordfence record

HighCVE-2025-60201

Customer Area < 8.3.4 - Unauthenticated Local File Inclusion

Published: July 21, 2025

Affected versions: [*, 8.3.4)
Patched versions: 8.3.4

Original Wordfence record

MediumCVE-2025-49982

WP Customer Area <= 8.2.5 - Missing Authorization

Published: June 19, 2025

Affected versions: *-8.2.5
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-12280

WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion

Published: January 6, 2025

Affected versions: *-8.2.4
Patched versions: 8.2.5

Original Wordfence record

MediumCVE-2024-12436

WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Bulk Deletion

Published: January 6, 2025

Affected versions: *-8.2.4
Patched versions: 8.2.5

Original Wordfence record

MediumCVE-2024-0665

WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

Published: January 23, 2024

Affected versions: *-8.2.2
Patched versions: 8.2.3

Original Wordfence record

Highest-Severity Records

HighCVE-2026-3464

WP Customer Area <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Read/Deletion via ajax_attach_file

Published: April 17, 2026

Affected versions: *-8.3.4
Patched versions: 8.3.5

Original Wordfence record

HighCVE-2022-4745

WP Customer Area <= 8.1.3 - Cross-Site Request Forgery

Published: January 17, 2023

Affected versions: *-8.1.3
Patched versions: 8.1.4

Original Wordfence record

HighCVE-2025-60201

Customer Area < 8.3.4 - Unauthenticated Local File Inclusion

Published: July 21, 2025

Affected versions: [*, 8.3.4)
Patched versions: 8.3.4

Original Wordfence record

MediumCVE-2026-7640

WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

Published: July 13, 2026

Affected versions: *-8.3.5
Patched versions: 8.3.6

Original Wordfence record

MediumCVE-2024-0665

WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting

Published: January 23, 2024

Affected versions: *-8.2.2
Patched versions: 8.2.3

Original Wordfence record

MediumCVE-2017-18519

WP Customer Area <= 7.4.2 - Cross-Site Scripting

Published: November 22, 2017

Affected versions: [*, 7.4.3)
Patched versions: 7.4.3

Original Wordfence record

MediumCVE-2026-42661

WP Customer Area <= 8.3.4 - Authenticated (Custom+) Path Traversal

Published: May 1, 2026

Affected versions: *-8.3.4
Patched versions: 8.3.5

Original Wordfence record

MediumCVE-2024-12280

WP Customer Area <= 8.2.4 - Cross-Site Request Forgery to Event Log Deletion

Published: January 6, 2025

Affected versions: *-8.2.4
Patched versions: 8.2.5

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-49982

WP Customer Area <= 8.2.5 - Missing Authorization

Published: June 19, 2025

Affected versions: *-8.2.5
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory