This vulnerability (CVE-2026-57384) is classified as CWE-79, indicating improper neutralization of input during web page generation, commonly known as cross-site scripting (XSS). It affects WishList Member X software versions up to 3.32.0. The vulnerability allows a subscriber-level user to inject malicious scripts, which could lead to partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with subscriber privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, and disruption of service. The CVSS score of 6.5 reflects a medium severity impact with network attack vector, low attack complexity, requiring privileges and user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit subscriber privileges where possible and monitor for suspicious activity related to script injection. Avoid relying on generic mitigations unless specifically recommended by the vendor.