CVE-2026-84960: WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires the victim to first visit the attacker-crafted URL and then click the Terms of Service link rendered on the resulting registration page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-members-membership-pluginto a version that resolves this vulnerability.Fixed in 3.5.6 - Compensating control
Since exploitation requires tricking a user into clicking the Terms of Service link, mitigate by warning users and preventing interaction with attacker-crafted registration/ToS flows (e.g., monitor/block suspicious registration pages and links at the application/WAF level).
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
A victim must be directed to an attacker-crafted URL that produces a registration page and must then click the Terms of Service link rendered on that page. The attacker does not need to authenticate, but successful exploitation depends on convincing the victim to perform those actions.
How can I determine whether my site is affected?
Sites using WP-Members Membership Plugin version 3.5.6 or earlier are affected. The provided information does not identify a configuration prerequisite beyond reaching the relevant registration page and Terms of Service link.