The MembershipWorks – Membership, Events & Directory plugin for WordPress allows an authenticated administrator or higher to inject arbitrary JavaScript into the plugin’s admin settings. Because the plugin does not properly sanitize or escape input, the stored payload is rendered when a page is viewed, enabling the attacker to execute arbitrary script in the context of the site. This vulnerability is a stored cross‑site scripting flaw, classified as CWE‑79.

All WordPress installations that use the MembershipWorks – Membership, Events & Directory plugin version 6.14 or earlier on multi‑site networks where the unfiltered_html filter is disabled are affected. The issue spans every version up to 6.14 and concerns the plugin’s settings panel that is accessible to users with administrator or higher privileges.

The CVSS score of 4.4 indicates a low to medium severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploit has been identified. Based on the description, it is inferred that the usual attack vector is an authenticated local attack through the plugin’s configuration UI; exploitation requires administrator‑level access and the presence of an attacker‑controlled payload embedded in plugin settings.