Reflected Cross-Site Scripting Vulnerability in WP-Members Membership Plugin for WordPress
CVE-2026-84960

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
WP-members Membership Plugin
Vendor
CVE Published:
11 September 2026

What is CVE-2026-84960?

The WP-Members Membership Plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability due to inadequate sanitization of user input and improper rendering of output. Attackers can exploit this weakness by crafting malicious URLs that, when visited by unsuspecting users, allow the injection of arbitrary web scripts into the affected pages. This exploitation unfolds when the victim interacts with a specially designed Terms of Service link on the registration page, leading to unauthorized script execution in the user's browser.

Affected Version(s)

WP-Members Membership Plugin 0 <= 3.5.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-members/tag...
https://plugins.trac.wordpress.org/browser/wp-members/tag...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuba
.