CVE-2026-84960 in WP-Members Membership Plugin
Summary
by MITRE • 09/11/2026
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The WP-Members plugin, a widely utilized solution for managing membership functionality within WordPress environments, contains a critical security flaw classified as Reflected Cross-Site Scripting. This vulnerability exists in all versions up to and including 3.5.6 and stems from insufficient input sanitization and output escaping mechanisms when processing URL query strings. The core technical failure lies in the application's inability to properly validate or encode user-supplied data before rendering it back into the HTML response, allowing malicious scripts to be injected directly via the request URI without requiring any form submission or authentication credentials.
From a technical perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attacker crafts a specific URL containing malicious JavaScript payload within its query parameters. When an unauthenticated user visits this crafted link, the server processes the request and reflects the unsanitized input back into the page content. However, due to the specific logic flow of the WP-Members plugin, the script does not execute immediately upon page load. Instead, it remains dormant until a subsequent interaction occurs on the rendered registration page.
The operational impact is significant because it enables unauthenticated attackers to compromise user sessions and potentially steal sensitive data such as cookies or session tokens. The exploitation chain requires two distinct steps for successful execution. First, the victim must be tricked into visiting the attacker-crafted URL through social engineering tactics like phishing emails or malicious links on other websites. Second, after the page loads with the injected script embedded in its structure, the victim must click the Terms of Service link rendered on that registration page. This specific trigger causes the browser to execute the stored payload within the context of the WordPress site, granting the attacker access to the user's authenticated session if they are logged in or allowing for further attacks against their account privileges.
This attack vector is categorized under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter: JavaScript, as it involves executing client-side scripts within a web browser environment. It also relates to T1189 Drive-by Compromise, where the initial access is gained through visiting a malicious URL that leads to further exploitation upon user interaction. The requirement for user interaction classifies this primarily as an active attack rather than passive drive-by downloading, yet it remains highly dangerous due to its reliance on social engineering and the high trust users place in legitimate-looking WordPress membership pages.
Mitigation strategies should focus on immediate remediation of the codebase alongside broader security hygiene practices. The most effective solution is to upgrade the WP-Members plugin to a version newer than 3.5.6, where these input sanitization and output escaping issues have been addressed by the developers. For organizations unable to update immediately due to compatibility constraints, implementing a Web Application Firewall can provide temporary protection by detecting and blocking requests containing known XSS payloads in query strings. Additionally, enforcing Content Security Policy headers that restrict script execution sources can mitigate the impact of successful injection attempts by preventing unauthorized scripts from running within the browser context. Regular security audits and code reviews focusing on input validation are essential to prevent similar vulnerabilities in future development cycles.