The Membership Plugin – Restrict Content plugin permits authenticated users with contributor level or higher to insert arbitrary JavaScript into page content by manipulating the 'register_form' and 'restrict' shortcodes. This stored XSS flaw allows the attacker to embed malicious code that executes whenever a user views the affected page, potentially leading to credential theft, session hijacking, or defacement of the site. The vulnerability arises from insufficient input sanitization and output escaping on user‑supplied attributes. Attackers cannot exploit it from an unauthenticated state; they must already have contribution privileges to manipulate the shortcodes.

StellarWP’s Membership Plugin – Restrict Content up to and including version 3.2.15 is affected. All installations where contributors or higher can edit content or add shortcodes are susceptible.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Attackers with contributor access can embed malicious scripts via the vulnerable shortcodes; no additional exploitation prerequisites are noted beyond authenticated contributor privileges. The impact is confined to users who load the page containing the injected code. The most likely attack vector involves content editors injecting malicious attributes into shortcodes that are then rendered on public pages.