Threats tagged 'ghsa-g5gq-75fv-5gwh'

The WP-Members Membership Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the WooCommerce Checkout Multicheckbox/Multiselect Field in all versions up to and including 3.5.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability is limited to the WooCommerce classic checkout path and does not affect sibling registration, profile, or account-edit handlers due to type error protections in PHP 8.