CVE-2026-84960 is a reflected cross-site scripting vulnerability in the WP-Members Membership Plugin for WordPress, affecting versions from 0 up to and including 3.5.6. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of URL query string parameters. Exploitation requires user interaction: the victim must visit a crafted URL and then click the Terms of Service link on the registration page, which triggers the execution of injected scripts.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or session hijacking. The vulnerability does not allow direct system compromise or denial of service but can compromise user trust and data confidentiality within the affected web application.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, avoid clicking suspicious links and consider implementing web application firewall (WAF) rules to detect and block malicious query strings targeting this plugin. Monitor for vendor updates to apply an official fix once released.