The WP-Members Membership Plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to the use of the add_query_arg function without proper escaping of URL parameters. This flaw exists in all plugin versions up to 3.4.9.5. An attacker can exploit this by crafting a malicious URL that, when visited by a user, executes arbitrary JavaScript in the context of the affected site. The vulnerability is unauthenticated and requires user interaction (clicking a link). The CVSS 3.1 base score is 6.1, indicating a medium severity impact with low attack complexity and no privileges required.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the vulnerable website for users who click on malicious links. This may result in information disclosure or session hijacking limited to the confidentiality and integrity impact vectors. There is no direct impact on availability. The vulnerability does not require authentication but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider implementing web application firewall (WAF) rules to detect and block malicious query parameters related to this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.