The SysBasics Customize My Account for WooCommerce plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the 'tab' parameter is not properly sanitized or escaped, enabling attackers to inject malicious scripts that execute in the context of the victim's browser upon interaction. This vulnerability affects all versions up to 2.7.29 and requires user interaction for exploitation. No known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of session cookies, redirection to malicious sites, or other script-based attacks. The vulnerability does not require authentication but does require user interaction (clicking a crafted link). There is no indication of impact on system availability.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until a patch is available, consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the 'tab' parameter. Avoid clicking on suspicious links related to the affected plugin. No vendor advisory states that no action is required or that the issue is already mitigated.