The WP‑Members Membership Plugin, versions up to 3.5.7, contains a stored cross‑site scripting flaw that is triggered when an authenticated user with subscriber or higher privileges submits a WooCommerce classic checkout form that includes a multicheckbox/multiselect field. The plugin processes this field with wpmem_sanitize_array, which does not correctly handle scalar input and fails to escape the stored value. As a result, an attacker can store malicious JavaScript that will run whenever a user views a page that includes the stored value.

Any WordPress installation that uses the WP‑Members Membership Plugin cbutlerjr, with the plugin version 3.5.7 or earlier and that has the WooCommerce classic checkout enabled, is affected. The vulnerability is tied specifically to the multicheckbox/multiselect field in the classic checkout path; other plugin handlers such as registration, profile, and account‑edit safely abort on scalar input.

The CVSS base score is 6.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated subscriber‑level access to submit a payload through the checkout form. Once the malicious script is stored, it executes for every user who views the affected page, providing an attacker persistent ability to inject code into visitors’ browsers.