Wp Members Membership Plugin
Monthly
Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.
Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.