Stored Cross-Site Scripting in WP-Members Membership Plugin for WordPress

CVE-2026-96565

What is CVE-2026-96565?

The WP-Members Membership Plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject malicious scripts into pages accessible to users. The exploit is contingent upon utilizing the WooCommerce classic checkout path, while other handlers mitigate the risk. It poses a significant security concern, enabling attackers to execute arbitrary web scripts upon user access.

References