WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

July 21, 2025 invoker category_cve

CVE Details

Basic Information

Title WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Type cve
Published 2025-07-22T04:25:07.143Z
Modified 2025-07-22T04:25:07.143Z

Product Information

Vendor cbutlerjr
Product WP-Members Membership Plugin
Version *

CVSS Information

Base Score 6.4 (MEDIUM)
Attack Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Analysis

AI Description The WP-Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization. This allows authenticated attackers with contributor-level access to inject scripts, which execute when users access the page. This affects versions up to 3.5.4.1.
AI Severity Medium
AI Vendor WordPress Community
AI Product WP-Members Membership Plugin
AI Version 3.5.4.1 and below

Affected Products

  • cbutlerjr WP-Members Membership Plugin *

Additional Information

CWE List CWE-79
Source Wordfence

Description

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘wpmem_login_link’ shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.