CVE-2026-12137 describes a reflected Cross-Site Scripting vulnerability in the SysBasics Customize My Account for WooCommerce plugin for WordPress. The issue is due to improper neutralization of input in the 'tab' parameter handled by the plugin_options_page() function, which is rendered only in the WordPress admin dashboard. Because the function is accessible only to users with Shop Manager-level privileges or higher, exploitation requires the victim to be authenticated with such access. The vulnerability allows injection of arbitrary web scripts that execute upon user interaction, potentially leading to limited confidentiality and integrity impacts within the admin context. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the WordPress admin dashboard for users with Shop Manager-level or higher privileges. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the admin interface. There is no indication of availability impact. The attack requires user interaction and authenticated access at a privileged level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Shop Manager-level and higher access to trusted users only. Avoid clicking on untrusted links that could trigger the reflected XSS. Monitor for updates from the plugin vendor regarding official patches or mitigations.