CVE-2026-96565
MediumCVSS 6.4Summary
The WP-Members Membership Plugin for WordPress is vulnerable to stored cross-site scripting via the WooCommerce Checkout Multicheckbox/Multiselect field (scalar bypass of wpmem_sanitize_array) in versions up to and including 3.5.7 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. It is only exploitable via the WooCommerce classic checkout path.
Risk Assessment
An attacker with a subscriber account could inject malicious scripts executed in other users' browsers, potentially leading to session theft or actions on behalf of victims. The risk affects WordPress sites using WooCommerce and WP-Members.
Recommendation
Update the WP-Members plugin to a version later than 3.5.7. Until updated, restrict registration and commenting by untrusted users.
Other vulnerabilities in WP-Members Membership Plugin
Original NVD description (English source)
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS