The MembershipWorks – Membership, Events & Directory plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated users with administrator privileges can inject arbitrary scripts through the plugin's admin settings interface. These scripts execute when any user accesses the affected pages. The issue specifically affects multi-site WordPress setups or installations with disabled unfiltered_html capability. The vulnerability is present in all versions up to and including 6.14. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker with administrator-level access to inject and execute arbitrary JavaScript in the context of affected pages. This can lead to limited confidentiality and integrity impacts within the scope of the affected WordPress multi-site or restricted HTML environments. There is no reported impact on availability. The vulnerability requires high privileges and has high attack complexity, reducing the likelihood of exploitation by lower-privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully control administrator access and consider the risks of running multi-site installations or disabling unfiltered_html. Monitoring vendor channels for updates is recommended.