CVE-2026-15324 is a stored cross-site scripting vulnerability (CWE-79) in the SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress. The flaw exists in the handling of the 'row_type' parameter, which lacks proper input sanitization and output escaping. This allows authenticated attackers with shop manager-level access or above to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 4.4.14.

An attacker with shop manager or higher privileges can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side impacts. The CVSS 3.1 base score is 4.4 (medium), reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only to reduce risk. Monitor vendor channels for updates and apply patches promptly once released.