Stored Cross-Site Scripting Vulnerability in WP-Members Membership Plugin for WordPress

CVE-2025-14448

What is CVE-2025-14448?

The WP-Members Membership Plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access and above to exploit insufficient input sanitization and output escaping in the Multiple Checkbox and Multiple Select user profile fields. This deficiency enables attackers to inject arbitrary web scripts, which can execute whenever an unsuspecting user accesses the compromised page. Website owners should update to the latest version to mitigate this risk and ensure their site remains secure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References