The WP‑Members Membership Plugin suffers from insufficient input sanitization and output escaping in its multiple checkbox and multiple select profile fields. This flaw permits a user with the Subscriber role or higher to store malicious JavaScript content that will run whenever another user views a page that displays the profile data. The injected scripts can steal cookies, hijack sessions, impersonate users, or deface content, affecting confidentiality, integrity, and trust of the site. The vulnerability is a classic stored XSS, rated CWE‑79.

All installations of the WP‑Members Membership Plugin version 3.5.4.3 and earlier (including all minor releases up to that point) are affected. The plugin must be installed on a WordPress site where users with Subscriber role or higher have the ability to edit profile fields. Only the plugin is impacted; other WordPress components remain unaffected.

The CVSS score of 5.4 signals a moderate severity while the EPSS of less than 1% indicates a low probability of exploitation in the short term. The flaw is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site, then use the profile editing interface to add malicious payloads to the multi‑select or checkbox fields. No additional privileges or external access vectors are required beyond the existing role permissions, making the vulnerability feasible for legitimate site subscribers.