CVE-2026-96565

Name of the Vulnerable Software and Affected Versions WP-Members Membership Plugin versions prior to 3.5.8

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the WooCommerce Checkout Multicheckbox/Multiselect Field through a scalar bypass of the wpmem sanitize array() function. Attackers can inject arbitrary web scripts into pages that execute when accessed by other users. This issue is specifically exploitable via the WooCommerce classic checkout path.

Recommendations Update WP-Members Membership Plugin to version 3.5.8 or later.