CVE-2026-4871 is a stored cross-site scripting vulnerability in the pstruik Sports Club Management WordPress plugin affecting all versions up to 1.12.9. The issue exists because the plugin does not properly sanitize or escape input passed via the 'before' and 'after' attributes of the scm_member_data shortcode. Authenticated attackers with Contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with Contributor-level or higher access can inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. Since the attacker must have authenticated access, the risk is limited to environments where such users exist.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the scm_member_data shortcode attributes 'before' and 'after' if possible. Monitor plugin updates from the vendor for a security patch addressing this issue.