Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T08:17:25.767Z",
  "pubdate": "2026-11-06T08:17:25.767Z",
  "executiveSummary": "The WCFM Membership plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw arises from the improper neutralization of user-supplied input during web page generation, allowing an attacker to inject and persist malicious scripts within the application database.\nThe vulnerability affects all versions of WCFM Membership from n/a through 2.12.0. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's session. This poses significant security risks, including session hijacking, unauthorized access to sensitive user data, and the potential for defacement or unauthorized administrative actions. Attackers capable of interacting with the plugin's input fields can trigger this vulnerability, potentially impacting both regular users and administrative accounts if the injected script is rendered in the backend or within user-facing dashboard views.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw within the WCFM Membership plugin (versions n/a through 2.12.0). The root cause is the failure of the application to adequately sanitize or encode user-controllable input before persisting it to the database and subsequently rendering it in HTML output. Because the input is treated as trusted content, the application inadvertently facilitates the execution of arbitrary JavaScript when the affected page is accessed by a legitimate user or administrator.\nThe attack flow begins when an authenticated attacker submits a crafted payload containing malicious JavaScript through an input field managed by the WCFM Membership plugin. Since the plugin lacks sufficient input validation or output escaping mechanisms, the malicious script is saved directly into the database. When a target user, such as an administrator or another vendor, views the dashboard or the specific page where this input is rendered, the web browser interprets the stored payload as legitimate script content, executing it within the victim's security context.\nExploitation requires the attacker to have the necessary permissions to interact with the input fields prone to injection within the WCFM Membership interface. Depending on the specific vector within the plugin, this might require a vendor-level account or a subscriber account if the input forms are exposed to lower-privileged users. The vulnerability is persistent, meaning the malicious payload remains active until the database record is manually cleared or the application's sanitization logic is corrected.\nUpon execution, the injected script can perform various malicious activities, such as extracting sensitive session cookies, capturing form data (including CSRF tokens), or performing unauthorized actions on behalf of the victim via the WordPress REST API or admin-ajax.php. Because the script executes within the victim’s session, it can bypass traditional authentication measures to manipulate settings or exfiltrate sensitive data from the WordPress backend. The lack of proper output encoding (e.g., using WordPress functions like esc_html() or esc_js()) is the primary technical failure enabling the persistence and execution of these malicious payloads."
}