WP Customer Area vulnerabilities

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute.

The WP Customer Area plugin versions up to 8.3.4 contain a Path Traversal vulnerability, which may allow unauthorized access to system files.

The WordPress plugin WP Customer Area before version 8.3.4 contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename for include/require statement. This allows an attacker to include local PHP files.