Stored Cross-Site Scripting Vulnerability in Membership Plugin for WordPress

CVE-2026-1304

What is CVE-2026-1304?

The Membership Plugin – Restrict Content for WordPress has a vulnerability that allows authenticated users with administrator-level access to inject malicious scripts through multiple invoice settings fields. Due to insufficient input sanitization and output escaping, these scripts can be executed on web pages accessed by other users, potentially compromising their data and security. This highlights the importance of securing input fields to prevent injected scripts from running within the application.

References