The Membership Plugin – Restrict Content for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, multiple invoice settings fields do not properly sanitize or escape input, allowing authenticated administrators to inject malicious scripts. These scripts execute in the context of users who view the injected pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability affects all versions up to 3.2.18. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change with low confidentiality and integrity impact and no availability impact.

An attacker with administrator-level access can inject persistent malicious scripts into invoice settings fields. These scripts execute whenever a user accesses the affected pages, potentially exposing user data or enabling actions on behalf of users. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires high privileges and does not require user interaction, limiting the attack surface to trusted administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and review invoice settings fields for suspicious content. Monitor vendor communications for updates on patches or official fixes.