The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into data handled by the WCFM Membership plugin. When the injected code is later rendered in a browser, the attacker can steal session cookies, hijack accounts, deface content, or perform further attacks against authenticated users. The CVSS score of 7.1 reflects a moderate to high severity with potential for significant impact on confidentiality and integrity for sites using the plugin.

The flaw affects the WordPress plugin WCFM Membership from WC Lovers. All releases from the earliest version up to and including 2.12.0 are vulnerable. No specific sub‑version ranges are listed; any installation using 2.12.0 or earlier should be considered at risk.

Because the flaw is a stored XSS, it can be triggered by any user who can submit data that the plugin stores, such as membership sign‑up or profile fields. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, so there is no current evidence of widespread exploitation. The most severe risk arises when the injected scripts execute in the browsers of privileged administrators or other authenticated users, potentially compromising administrative access. Updating the plugin to version 2.12.1 or later removes the vulnerability. In the absence of an immediate update, the risk remains until mitigated.