The WP‑Members Membership Plugin for WordPress contains a stored cross‑site scripting flaw in the ‘wpmem_login_link’ shortcode. The plugin does not properly sanitize or escape user‑supplied attributes, enabling an attacker with contributor-level access or greater to inject arbitrary JavaScript. Whenever a user views a page that contains the injected shortcode, the attacker’s script runs in that visitor’s browser, potentially hijacking sessions, stealing data, or defacing the site.

All WordPress sites that have the WP‑Members plugin by cbutlerjr installed in version 3.5.4.1 or earlier are affected. Any site running this plugin with contributor or higher privileges is vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability requires the attacker to be logged in with sufficient privileges, implying that it is not a public remote exploit. The attack would likely proceed by adding or editing a post or page that contains the vulnerable shortcode, placing malicious code that runs for all visitors who load that page. Because the flaw is not in the core WordPress installation but in a third‑party plugin, sites that are not using WP‑Members or have upgraded past 3.5.4.1 are not at risk.