This vulnerability (CWE-79) in the ARMember Membership Plugin allows stored XSS due to improper input neutralization during web page generation. It affects versions through 4.0.23. The CVSS 3.1 score is 5.9 (medium severity), with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official fix has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. This can lead to partial disclosure of information, modification of data, and limited disruption of service. The impact is rated medium with low-level confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit high-privilege user access and exercise caution with user-generated content. Monitor for updates from Repute Infosystems regarding patches or mitigations.