CVE-2026-1304: WordPress Membership Plugin XSS Flaw

CVE-2026-1304 Overview

The Membership Plugin – Restrict Content for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting multiple invoice settings fields in all versions up to and including 3.2.18. The vulnerability arises from insufficient input sanitization and output escaping in the plugin's settings handling code.

This flaw enables authenticated attackers with administrator-level access to inject arbitrary web scripts into pages that execute whenever any user accesses an injected page. While requiring high privileges to exploit, the stored nature of this XSS means malicious scripts persist and can affect multiple users over time.

Critical Impact

Authenticated administrators can inject persistent malicious scripts via invoice settings fields, potentially compromising other admin accounts or facilitating privilege persistence in multi-admin WordPress environments.

Affected Products

• Membership Plugin – Restrict Content for WordPress versions up to and including 3.2.18
• WordPress sites using vulnerable versions of the Restrict Content plugin
• Invoice functionality within the Restrict Content plugin (settings.php and invoice.php)

Discovery Timeline

• 2026-02-18 - CVE-2026-1304 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1304

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the administrative settings interface of the Restrict Content plugin, specifically in the invoice configuration functionality. The vulnerable code spans multiple settings fields located in core/includes/admin/settings/settings.php (lines 896, 905, 914, 923, 932, 941, 950, and 971) and the invoice template file at core/templates/invoice.php (lines 271 and 281).

The vulnerability requires administrator-level authentication to exploit, which limits the immediate attack surface. However, the stored nature of the XSS payload means that once injected, the malicious script persists in the database and executes whenever any user views pages that render the affected invoice settings or generated invoices.

In WordPress environments with multiple administrators or in scenarios where administrator accounts may be compromised, this vulnerability could be leveraged for privilege persistence, session hijacking of other admin accounts, or as a stepping stone for further attacks against site visitors viewing invoices.

Root Cause

The root cause of CVE-2026-1304 is insufficient input sanitization on data entry and inadequate output escaping when rendering invoice settings fields. The plugin fails to properly sanitize user-supplied input through WordPress security functions like sanitize_text_field() or wp_kses() before storing data in the database. Additionally, when outputting these stored values, the plugin does not apply proper escaping functions such as esc_html() or esc_attr(), allowing stored JavaScript payloads to execute in the browser context.

This represents a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability pattern where both input validation and output encoding controls are missing or inadequate.

Attack Vector

The attack requires network access and administrator-level authentication to the WordPress dashboard. An attacker with these privileges would navigate to the Restrict Content plugin's invoice settings page and inject malicious JavaScript code into one or more of the vulnerable settings fields.

The injected script is stored in the WordPress database and subsequently rendered without proper escaping when:

1. Other administrators view the settings page
2. Users access pages displaying invoice information
3. Invoice templates are rendered for payment confirmations

The malicious script then executes in the victim's browser context, potentially stealing session cookies, performing actions on behalf of the victim, or redirecting users to malicious sites.

Detection Methods for CVE-2026-1304

Indicators of Compromise

• Unexpected JavaScript code or HTML tags present in Restrict Content plugin invoice settings fields in the wp_options database table
• Suspicious entries containing <script>, onerror=, onload=, or similar XSS payload patterns in invoice-related option values
• Browser console errors or unexpected network requests when viewing invoice settings or generated invoices

Detection Strategies

• Review WordPress database options related to Restrict Content invoice settings for any HTML or JavaScript injection attempts
• Monitor WordPress admin activity logs for unusual modifications to Restrict Content plugin settings
• Implement Web Application Firewall (WAF) rules to detect XSS payload patterns in POST requests to WordPress admin pages
• Use WordPress security plugins to scan for stored XSS patterns in the database

Monitoring Recommendations

• Enable comprehensive logging for all WordPress admin actions, particularly plugin settings modifications
• Configure real-time alerting for changes to Restrict Content plugin configuration
• Implement Content Security Policy (CSP) headers to mitigate XSS impact and generate violation reports
• Regularly audit administrator accounts and their recent activity for signs of compromise

How to Mitigate CVE-2026-1304

Immediate Actions Required

• Update the Membership Plugin – Restrict Content for WordPress to a patched version newer than 3.2.18
• Audit existing invoice settings for any suspicious content or injected scripts
• Review administrator account activity and verify no unauthorized configuration changes have been made
• Implement Content Security Policy headers to reduce XSS impact while patches are being applied

Patch Information

The vulnerability affects all versions of the Restrict Content plugin up to and including 3.2.18. Site administrators should update to the latest patched version available in the WordPress plugin repository. The fix addresses the missing input sanitization and output escaping in the invoice settings functionality.

Detailed changeset information is available in the WordPress Restrict Content Changeset Overview. Additional vulnerability details can be found in the Wordfence Vulnerability Report.

Workarounds

• Limit administrator account access to only trusted personnel until the plugin can be updated
• Implement a Web Application Firewall with XSS filtering rules for WordPress admin endpoints
• Temporarily disable the invoice settings functionality if not critical to business operations
• Add Content Security Policy headers to restrict inline script execution:

# Apache .htaccess CSP header configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';";