{"id":"CVE-2026-96565","aliases":["EUVD-2026-119143","GHSA-g5gq-75fv-5gwh"],"status":"published","title":"WP-Members Membership Plugin \u003c= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field","description":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00343,"percentile":0.28113,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-07T11:26:27Z","modified":"2026-11-07T12:32:02Z","products":[{"vendor":"cbutlerjr","product":"wp-members membership plugin"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/3872211b-b7d9-4d71-a371-9099392b4678?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/admin/class-wp-members-admin-users.php#L555"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L540"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L372"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/vendor/rocketgeek-utilities/includes/forms.php#L143"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L530"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3753517%40wp-members%2Ftrunk\u0026old=3686809%40wp-members%2Ftrunk"},{"url":"https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.8/includes/admin/class-wp-members-admin-users.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96565"},{"url":"https://github.com/advisories/GHSA-g5gq-75fv-5gwh"}],"sources":{"cve":[{"id":"CVE-2026-96565","title":"WP-Members Membership Plugin \u003c= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field","description":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.","status":"published","published":"2026-11-07T11:26:27.608Z","modified":"2026-11-07T18:06:01.374Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T12:33:58.735172Z"}],"euvd":[{"id":"EUVD-2026-119143","description":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.","status":"published","published":"2026-11-07T11:26:27Z","modified":"2026-11-07T18:06:01Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T15:09:43.759879Z"}],"ghsa":[{"id":"GHSA-g5gq-75fv-5gwh","title":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site...","description":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.","status":"published","published":"2026-11-07T12:31:53Z","modified":"2026-11-07T12:32:02Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T12:37:15.096654Z"}],"nvd":[{"id":"CVE-2026-96565","description":"The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.","status":"published","published":"2026-11-07T12:17:47.607Z","modified":"2026-11-07T18:17:30.127Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T20:06:33.603746Z"}]}}