The vulnerability allows any authenticated administrator to inject arbitrary JavaScript into the Clubmember plugin settings page. Because the input is not sanitized and the output is not properly escaped, the injected script is stored and then rendered on pages that load the plugin’s configuration. A compromised page will execute the attacker’s script in the browsers of any user who visits the affected page, potentially enabling cookie theft, session hijacking, or other client‑side attacks.

The affected product is the Clubmember plugin for WordPress, maintained by alaminopu, in all releases through 0.2 inclusive. The flaw is present only on multi‑site WordPress environments and only when the unfiltered_html capability is disabled. No other WordPress core components are affected. Users should verify the plugin version on their sites and ensure it is either updated to 0.3 or newer or removed from the installation.

The CVSS v3.1 score of 4.4 indicates moderate severity. The EPSS score is less than 1 %, and it is not listed in the CISA KEV catalog, implying a low likelihood that this weakness is being actively exploited. Nonetheless, the impact is confined to users who have visited an affected page after an administrator injected the script. The attack vector requires the attacker to log in as administrator or a role with equal or higher permissions and edit the Clubmember settings. Successful exploitation results in client‑side code execution on any visitor to the site.