WP-Members Membership Plugin – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1987 | WordPress Plugin Vulnerability Report

Plugin Name: WP-Members Membership Plugin

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-members
  • Software Status: Active
  • Software Author: cbutlerjr
  • Software Downloads: 3,443,217
  • Active Installs: 60,000
  • Last Updated: March 12, 2024
  • Patched Versions:
  • Affected Versions: <=

Vulnerability Details:

  • Name: WP-Members Membership Plugin <=
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1987
  • CVSS Score: 6.4
  • Publicly Published: March 7, 2024
  • Researcher: Sh
  • Description: The WP-Members Membership Plugin has been identified with a vulnerability in its shortcode(s) processing, where insufficient input sanitization and output escaping allow authenticated attackers to inject harmful scripts. This Stored Cross-Site Scripting (XSS) vulnerability affects all plugin versions up to and including, posing a risk whenever a user accesses a page with the injected script.


The WP-Members Membership Plugin, a popular solution for adding membership features to WordPress sites, has encountered a critical security flaw in versions up to This vulnerability allows for the injection and execution of arbitrary web scripts through the plugin's shortcodes, compromising site integrity and user safety. A fix has been implemented in version to address this serious security concern.

Detailed Overview:

Discovered by the researcher known as Sh, this vulnerability underscores the importance of stringent input validation and output encoding in plugin development. The ability to exploit shortcodes to execute unauthorized scripts poses significant risks, including data breaches and unauthorized site alterations. The rapid response from the plugin's author, cbutlerjr, in releasing a patched version highlights the critical nature of maintaining security in widely used plugins.

Advice for Users:

  • Immediate Action: It's imperative for users of the WP-Members Membership Plugin to update to the latest patched version,, immediately. This update rectifies the XSS vulnerability, safeguarding against potential exploits.
  • Check for Signs of Vulnerability: Users should monitor their sites for any unusual behavior or content modifications that could suggest exploitation. Early detection is key to preventing further damage.
  • Alternate Plugins: While the patched version is deemed secure, exploring other membership plugins may provide peace of mind or additional features that better suit specific needs.
  • Stay Updated: Regularly updating all WordPress components, including plugins and themes, is crucial for security. Staying informed about the latest patches and updates can prevent many common vulnerabilities.


The identification and prompt resolution of CVE-2024-1987 within the WP-Members Membership Plugin serves as a vital reminder of the ongoing vigilance required in the digital landscape. For WordPress site administrators, particularly those overseeing small business websites, the commitment to regular updates and cybersecurity best practices is indispensable. Ensuring the use of secure, up-to-date plugins is fundamental to protecting not only the website's operational integrity but also the trust and safety of its users.


In today's digital landscape, where WordPress serves as the cornerstone for countless businesses and personal sites, the revelation of a vulnerability within a widely-used plugin like WP-Members Membership Plugin is a stark reminder of the perpetual need for cybersecurity vigilance. The recent identification of CVE-2024-1987, an Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability, has cast a spotlight on the critical importance of keeping digital platforms up to date to safeguard against potential security threats.

Plugin Overview:

WP-Members Membership Plugin, crafted by cbutlerjr, is esteemed for its functionality, enabling WordPress users to create exclusive membership areas seamlessly. With over 3 million downloads and 60,000 active installations, its impact on the WordPress community is substantial. Regular updates, the latest being on March 12, 2024, have contributed to its robustness, with version addressing the current security concern.

Vulnerability Details:

CVE-2024-1987 unveils a vulnerability within versions up to of the plugin, where insufficient input sanitization and output escaping within shortcode processing could allow attackers to embed malicious scripts. This flaw, discovered by researcher Sh and publicly disclosed on March 7, 2024, poses a significant risk as these scripts can execute upon page access, compromising site and user security.

Risks and Potential Impacts:

The exploitation of this vulnerability could lead to unauthorized data access, manipulation of site content, and the distribution of malware to unsuspecting visitors. For small business owners, the ramifications could extend beyond the digital realm, affecting customer trust and potentially leading to tangible financial losses.

Remediation and Prevention:

To mitigate this risk, users are urged to update to the patched version,, immediately. Beyond this immediate action, regular monitoring for unusual site activity and remaining informed about updates are pivotal in maintaining site security. For those seeking additional assurances, exploring alternative membership plugins may provide peace of mind.

Previous Vulnerabilities:

This is not the first challenge faced by the WP-Members Membership Plugin, with six vulnerabilities reported since January 7, 2014. Each incident has been a learning opportunity, reinforcing the importance of continuous improvement and vigilance in software development and maintenance.

The discovery and resolution of CVE-2024-1987 within the WP-Members Membership Plugin underscore a critical lesson for all digital platform operators, especially small business owners who might lack extensive IT infrastructure. Staying abreast of vulnerabilities and ensuring timely application of patches is not just a technical necessity but a fundamental aspect of digital stewardship. In the rapidly evolving cyber landscape, proactive security measures are integral to protecting not just the operational integrity of online platforms but also the invaluable trust of their users.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP-Members Membership Plugin – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-1987 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment