Subscriber XSS in WishList Member X <= 3.32.0

Executive Summary

CVE-2026-57384 is a Subscriber Cross Site Scripting (XSS) vulnerability affecting WishList Member X plugin versions 3.32.0 and below. It allows attackers to inject malicious scripts into a website by tricking a privileged user into interacting with a crafted link, page, or form. The vulnerability has a CVSS score of 6.5, indicating moderate severity.

Useful 0 Not Useful 0

Detection Guidance

Detecting this XSS vulnerability requires monitoring for suspicious activity or reviewing access logs for interactions with the WishList Member X plugin. Check for unusual script injections in user input fields or redirects. No specific commands are provided in the context, but inspecting web server logs for POST/GET requests targeting the plugin and analyzing user-generated content for malicious scripts may help.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to inject malicious scripts such as redirects or advertisements into your website. Successful exploitation requires a user with Subscriber or Developer privileges to interact with a malicious link or form. The impact includes potential defacement, data theft, or unauthorized actions on your site.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WishList Member X plugin to version 3.33.0 or later to patch the vulnerability. Apply Patchstack's mitigation rule to block attacks until the update is completed. Restrict user privileges to the minimum required, especially for Subscriber or Developer roles, to reduce exploitation risk.

Useful 0 Not Useful 0