CVE-2026-15324 is a stored cross-site scripting vulnerability in the SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress. The issue exists in the 'row_type' parameter, which lacks proper input sanitization and output escaping, allowing authenticated attackers with shop manager-level access or above to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 4.4.14. No official patch or remediation guidance has been provided as of the published date.

An attacker with shop manager-level privileges or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side impacts. The CVSS 3.1 base score is 4.4 (medium severity), reflecting the requirement for high privileges and the lack of user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager-level access to trusted users only and consider monitoring or limiting the use of the 'row_type' parameter in the plugin settings. Avoid granting unnecessary privileges to users to reduce the risk of exploitation.