WCFM Membership WordPress plugin stored XSS flaw

Attackers can plant bad code in a WordPress membership plugin.

Summary

A stored cross-site scripting flaw in the WCFM Membership WordPress plugin lets an attacker save malicious scripts that run in other users' browsers. Versions through 2.12.0 are affected.

What to do

Update to 2.12.1 or newer.

Products and platforms

WC Lovers WCFM Membership

CVE IDs

CVE-2026-39744 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 08:00 UTC

First seen 2026-11-09 17:40 UTC