CVE-2026-12136 is a stored cross-site scripting vulnerability in the Customize My Account For WooCommerce plugin for WordPress, specifically in the 'sysbasics_user_avatar' shortcode. The issue is caused by improper neutralization of input in the wcmamtx_get_avatar_default() function, where user-supplied attributes (min_height, min_width, max_height, max_width) are concatenated without proper sanitization or escaping into the get_avatar() extra_attr style attribute. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript that executes in the context of users visiting the injected pages.

An attacker with Contributor-level or higher access can exploit this vulnerability to perform stored cross-site scripting attacks, potentially leading to session hijacking, privilege escalation, or other malicious actions executed in the context of other users viewing the compromised pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable shortcode if possible. Monitor for updates from the vendor phppoet regarding patches or official fixes.