{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7495", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-11T14:49:02.447Z", "datePublished": "2025-07-22T04:25:07.143Z", "dateUpdated": "2026-04-08T17:09:49.296Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:49.296Z"}, "affected": [{"vendor": "cbutlerjr", "product": "WP-Members Membership Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.5.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/942df4bc-2a17-4add-9664-60d77319b93a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/class-wp-members-shortcodes.php#L1092"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/api/api.php#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331571%40wp-members&new=3331571%40wp-members&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-11T16:22:44.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-21T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-22T16:27:53.546210Z", "id": "CVE-2025-7495", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-22T16:32:00.644Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7495", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-22T16:27:53.546210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-22T16:31:22.937Z"}}], "cna": {"title": "WP-Members <= 3.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "muhammad yudha"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "cbutlerjr", "product": "WP-Members Membership Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.5.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-11T16:22:44.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-21T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/942df4bc-2a17-4add-9664-60d77319b93a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/class-wp-members-shortcodes.php#L1092"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/api/api.php#L144"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331571%40wp-members&new=3331571%40wp-members&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-22T04:25:07.143Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7495", "state": "PUBLISHED", "dateUpdated": "2025-07-22T16:32:00.644Z", "dateReserved": "2025-07-11T14:49:02.447Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-22T04:25:07.143Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WP-Members Membership Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'wpmem_login_link' en todas las versiones hasta la 3.5.4.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-7495", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-07-22T05:15:41.377", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/api/api.php#L144"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/class-wp-members-shortcodes.php#L1092"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-members/tags/3.5.4.1/includes/vendor/rocketgeek-utilities/includes/utilities.php#L259"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3331571%40wp-members&new=3331571%40wp-members&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/942df4bc-2a17-4add-9664-60d77319b93a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:03:58.506969+00:00", "value": {"mitigation_remediation": ["Upgrade the WP\u2011Members plugin to a version newer than 3.5.4.1, which removes the vulnerability.", "Restrict contributor or higher access to only trusted users or disable the ability to edit content that contains the \u2018wpmem_login_link\u2019 shortcode.", "If an upgrade is not immediately possible, avoid using the affected shortcode on publicly accessible pages and manually sanitize or escape any attributes before rendering."], "summary": {"action": "Immediate Patch", "impact": "Stored XSS that allows an authenticated contributor or higher to inject scripts which will execute in every visitor\u2019s browser"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the WP\u2011Members plugin by cbutlerjr installed in version 3.5.4.1 or earlier are affected. Any site running this plugin with contributor or higher privileges is vulnerable.", "description_and_impact": "The WP\u2011Members Membership Plugin for WordPress contains a stored cross\u2011site scripting flaw in the \u2018wpmem_login_link\u2019 shortcode. The plugin does not properly sanitize or escape user\u2011supplied attributes, enabling an attacker with contributor-level access or greater to inject arbitrary JavaScript. Whenever a user views a page that contains the injected shortcode, the attacker\u2019s script runs in that visitor\u2019s browser, potentially hijacking sessions, stealing data, or defacing the site.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability requires the attacker to be logged in with sufficient privileges, implying that it is not a public remote exploit. The attack would likely proceed by adding or editing a post or page that contains the vulnerable shortcode, placing malicious code that runs for all visitors who load that page. Because the flaw is not in the core WordPress installation but in a third\u2011party plugin, sites that are not using WP\u2011Members or have upgraded past 3.5.4.1 are not at risk."}}}}, "created": "2025-07-22T12:49:31.688799+00:00", "updated": "2026-04-22T01:15:07.300384+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}