The flaw is an Improper Neutralization of Input During Web Page Generation that allows a stored Cross‑Site Scripting (XSS) vulnerability in the WP‑Members plugin. An attacker can embed malicious scripts into content that the plugin saves, which are then executed in the browsers of other users who view that content, potentially allowing session hijacking, cookie theft, or defacement.

The vulnerability affects the WordPress WP‑Members plugin provided by Chad Butler, versions from the initial release up to and including 3.5.4.

The CVSS score of 6.5 denotes moderate severity, while the EPSS of less than 1% indicates a low likelihood of exploitation at present; the issue is not listed in the CISA KEV catalog. The likely attack vector is a web form or input field that stores user data—such as comments or registration fields—without proper sanitization. Once the malicious payload is stored, any visitor who loads the affected page will have the script executed in their browser.