CVE-2026-96565

Description

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 6.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Effective score: 6.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-79
Reserved: 2026-09-23
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:06 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/96xxx/CVE-2026-96565.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119143

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
cbutlerjr	WP-Members Membership Plugin	`0` (affected)	—

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

October 20 Advisory: Plex Media Server Remote Code Execution Chain [CVE ...

web:censys.com

Vulnerability Description CVE - 2026 -96652, CVE - 2026 -96654, CVE - 2026 -96655, and CVE - 2026 -96656 are four flaws in Plex Media Server before build 1.43.3.10861 that chain into remote code execution as the account running the server. Scored individually they look less severe: CVE - 2026 -96656, an arbitrary file write through the transcoder preferences, is the highest at 7.2, CVE - 2026 -96654 is 6.5, and ...

2026-11-08 11:09 UTC
Plex Security Update: Fix CVE-2026-96652 | ComputingForGeeks

web:computingforgeeks.com

Plex Media Server before 1.43.3.10861 is vulnerable to CVE - 2026 -96652. Update Docker or apt installs the tested way and run the compromise check.

2026-11-08 11:09 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-08 11:09 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:09 UTC
[Security Advisory] September 2026 CVE Advisory Notification

web:support.servicenow.com

What you need to know: On September 24, 2026 , ServiceNow issued CVE - 2026 -86857, CVE - 2026 -86858, CVE - 2026 -13016, CVE - 2026 -86859, and CVE - 2026 -86860. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security ...

2026-11-08 11:09 UTC
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux ...

web:thehackernews.com

Attackers exploit four Plex Media Server flaws chained as Plex2Shell to deploy XMRig miners and reverse proxy software after PoC release.

2026-11-08 11:09 UTC
CVE-2026-96656 - vulnerability database | Vulners.com

web:vulners.com

Plex Media Server versions before 1.43.3.10861 are vulnerable to an arbitrary file write (CWE-73) that leads to Remote Code Execution (RCE) . The flaw exists because the TranscoderH264Options preference is appended verbatim to the x264 option stri...

2026-11-08 11:09 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-08 11:09 UTC
CVE-2026-96656: Plex Media Server RCE Vulnerability - SentinelOne

web:www.sentinelone.com

CVE - 2026 -96656 is a remote code execution vulnerability in Plex Media Server. Learn about its impact, affected versions, and mitigation methods.

2026-11-08 11:09 UTC
Synology Inc.

web:www.synology.com

Centralize data storage and backup, streamline file collaboration, optimize video management, and secure network deployment to facilitate data management.

2026-11-08 11:09 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-96565.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:59.921587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:01.374Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP-Members Membership Plugin",
          "vendor": "cbutlerjr",
          "versions": [
            {
              "lessThanOrEqual": "3.5.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jacek Sowi\u0144ski (dzaku)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization, which raises a PHP 8 TypeError on scalar input and fails closed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:27.608Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3872211b-b7d9-4d71-a371-9099392b4678?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/admin/class-wp-members-admin-users.php#L555"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L540"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L372"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/vendor/rocketgeek-utilities/includes/forms.php#L143"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.7/includes/api/api-forms.php#L530"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=&new=3753517%40wp-members%2Ftrunk&old=3686809%40wp-members%2Ftrunk"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.8/includes/admin/class-wp-members-admin-users.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-23T13:43:34.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:49:51.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-96565",
    "datePublished": "2026-11-07T11:26:27.608Z",
    "dateReserved": "2026-09-23T13:18:47.831Z",
    "dateUpdated": "2026-11-07T18:06:01.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}