CVE-2026-57384

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

WishList Member X plugin version 3.32.0 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. A subscriber can inject malicious script.

Risk Assessment

The organization is at risk of user session theft, website defacement, or theft of member data.

Recommendation

Update the WishList Member X plugin to a version above 3.32.0.

Other vulnerabilities in WishList Member X

See all

CVE-2026-24575Medium
There is a broken access control issue in WishList Member X versions up to 3.29.0 that may allow unauthorized access to subscribers.
CVE-2026-25446Critical
In WishList Member X versions up to 3.29.0, there is a vulnerability that allows subscribers to upload arbitrary files.

Original NVD description (English source)

Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.