Stored Cross-Site Scripting Vulnerability in Membership Plugin for WordPress

CVE-2026-1304

What is CVE-2026-1304?

The Membership Plugin – Restrict Content for WordPress has a vulnerability that allows authenticated users with administrator-level access to inject malicious scripts through multiple invoice settings fields. Due to insufficient input sanitization and output escaping, these scripts can be executed on web pages accessed by other users, potentially compromising their data and security. This highlights the importance of securing input fields to prevent injected scripts from running within the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References