Understanding the WP-Members Membership Plugin XSS Vulnerability
A security flaw has been found in the WP-Members Membership Plugin for WordPress that could allow malicious scripts to be injected into websites. This vulnerability, identified as CVE-2025-14448, is a type of attack called Stored Cross-Site Scripting (XSS). It affects specific user profile fields within the plugin, particularly the “Multiple Checkbox” and “Multiple Select” options.
In simple terms, an attacker who has logged into a WordPress site with at least a Subscriber-level account can insert harmful code into these profile fields. This code then gets stored on the website. Whenever another user, including site administrators, views a page containing the injected content, the malicious script will run in their web browser. This can lead to various issues, such as stealing sensitive information, redirecting users to dangerous websites, or defacing web pages.
CVE Details
- Product: WP-Members Membership Plugin for WordPress
- Published Date: January 15, 2026
- Severity: Medium (CVSS Score 5.4)
- Status: Analyzed
Affected Products
The Stored Cross-Site Scripting vulnerability impacts the WP-Members Membership Plugin for WordPress across all versions up to, and including, 3.5.4.3. If you are running any version within this range, your website may be at risk.
Current Status
This vulnerability has been thoroughly analyzed. The good news is that a fix has been developed and released by the plugin’s developers to address the issue. The patch focuses on improving input sanitization and output escaping to prevent malicious script injection.
Severity Level
The CVE-2025-14448 vulnerability is rated as Medium severity with a CVSS score of 5.4. A “Medium” rating means that while the vulnerability is not trivial, exploiting it typically requires certain conditions or user privileges. In this case, an attacker needs to be an authenticated user with at least a Subscriber-level role on your WordPress site to inject the scripts. However, once injected, the script can affect any user viewing the compromised page, including higher-privileged users like administrators.
Possible Solutions
The most important step to protect your WordPress site from this vulnerability is to update your WP-Members Membership Plugin to the patched version. The fix is included in version 3.5.4.4 and later. It is highly recommended to upgrade your plugin immediately to ensure the security of your user profiles and overall website integrity.
Always remember to back up your website before performing any updates.
References
https://plugins.trac.wordpress.org/changeset/3418471/wp-members
https://www.wordfence.com/threat-intel/vulnerabilities/id/89d1fa00-4757-4f86-bddb-a6a2dbcf9625?source=cve
