Cross-Site Scripting Vulnerability in WCFM Membership Plugin by WC Lovers
CVE-2026-39744

7.1HIGH

Key Information:

Vendor

WordPress
Status
Wcfm Membership
Vendor
CVE Published:
6 November 2026

What is CVE-2026-39744?

A vulnerability in the WCFM Membership plugin by WC Lovers allows for stored cross-site scripting (XSS) attacks. This issue is due to improper neutralization of input during web page generation, enabling attackers to inject malicious scripts. When exploited, this vulnerability can compromise user data and lead to unauthorized actions on the site. It affects versions up to and including 2.12.0, posing a risk for websites that utilize this plugin without appropriate security measures.

Affected Version(s)

WCFM Membership 0 <= 2.12.0

References

https://patchstack.com/database/wordpress/plugin/wc-multi...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.