Input validation vulnerability in Simple Membership 4.3.5

The Simple Membership plugin for WordPress, which is used up to version 4.3.5, has a vulnerability that could allow unauthenticated attackers to inject malicious web scripts into webpages. This is possible because the plugin does not properly sanitize and escape user input from the ‘list_type’ parameter. To exploit this vulnerability, attackers must trick users into taking an action, such as clicking a malicious link.