Stored Cross-Site Scripting Vulnerability in WP-Members Membership Plugin for WordPress
CVE-2025-14448

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
WP-members Membership Plugin
Vendor
CVE Published:
15 January 2026

What is CVE-2025-14448?

The WP-Members Membership Plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to exploit insufficient input sanitization and output escaping in the Multiple Checkbox and Multiple Select user profile fields. This deficiency enables attackers to inject arbitrary web scripts, which can execute whenever an unsuspecting user accesses the compromised page. Website owners should update to the latest version to mitigate this risk and ensure their site remains secure.

Affected Version(s)

WP-Members Membership Plugin 0 <= 3.5.4.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3418471/wp-m...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Angus Girvan
.