The WP‑Members Membership Plugin allows authenticated users with contributor or higher privileges to inject arbitrary web scripts by manipulating attributes of the wpmem_user_memberships shortcode due to insufficient input sanitization and output escaping. This stored XSS flaw enables the attacker to place malicious code that will execute in the browsers of any visitor who loads a page containing the compromised shortcode, potentially compromising user credentials, defacing the site, or hijacking sessions.

WordPress installations that have the WP‑Members plugin version 3.5.2 or earlier enable the vulnerable shortcode. Sites using these plugin versions are susceptible when an attacker has contributor, editor, administrator, or other privileged roles.

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in current conditions. It is not listed in the CISA KEV catalog. Attackers must be authenticated with at least contributor access and exploit the shortcode’s attribute handling; unauthenticated users cannot trigger the vulnerability. Once injected, the malicious script executes whenever a user loads a page that contains the compromised shortcode.