The vulnerability is an Improper Neutralization of Input During Web Page Generation, which allows a reflected XSS attack. An attacker can inject malicious scripts that will execute in the context of the victim’s browser, potentially enabling session hijacking, defacement, or permission escalation. This flaw is identified as CWE‑79.

The affected product is the DaleAB Membee Login WordPress plugin, versions from the initial release through 2.3.6.

The CVSS score is 7.1, indicating high impact. The EPSS score is <1%, showing very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because it is a reflected XSS, an attacker can craft a malicious URL that injects script into the plugin’s input handling. Based on the description, it is inferred that exploitation requires user interaction but is straightforward to execute.