What is the CVSS score of CVE-2026-57384?

CVE-2026-57384 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

WishList Member X CVE-2026-57384

EUVD-2026-48166 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-35q4-rjfj-7r6x

WordPress XSS Wordpress Plugin Wishlist Member X

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber account required (PR:L), scope changes to victim browser (S:C), but XSS does not credibly impact server availability (A:N).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:05 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.

AnalysisAI

Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.

Technical ContextAI

WishList Member X is a WordPress membership management plugin identified under CPE cpe:2.3:a:membership_software:wishlist_member_x:*:*:*:*:*:*:*:*. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning subscriber-supplied input is insufficiently sanitized or escaped before being rendered in HTML output. The CVSS Scope Changed attribute (S:C) is characteristic of stored XSS where the vulnerable component is the plugin/server, but the exploited component is the victim's browser - a separate security scope. The low attack complexity (AC:L) indicates no race conditions or special timing are needed beyond having a subscriber account.

RemediationAI

Upgrade WishList Member X to a version above 3.32.0 - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wishlist-member/vulnerability/wordpress-wishlist-member-x-plugin-3-32-0-cross-site-scripting-xss-vulnerability should be consulted for the exact patched release version, which was not independently confirmed in the available data. As a compensating control prior to patching, restrict subscriber registration on the affected WordPress site to trusted users only, which removes the primary attacker entry point (PR:L requires a valid subscriber account). Additionally, deploying a WordPress-aware Web Application Firewall rule targeting XSS patterns in plugin-controlled input fields can reduce exploitation risk, though WAF bypass remains possible for determined attackers. WordPress administrators should also review Content Security Policy headers to limit the damage from any injected scripts that do execute.