CVE-2025-7495: WP-Members Plugin Stored XSS Vulnerability

CVE-2025-7495 Overview

CVE-2025-7495 is a stored cross-site scripting (XSS) vulnerability in the WP-Members Membership Plugin for WordPress. The flaw affects all plugin versions up to and including 3.5.4.1. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the wpmem_login_link shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, including administrators.

Critical Impact
Contributor-level users can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and content manipulation.

Affected Products

WP-Members Membership Plugin for WordPress — all versions through 3.5.4.1
Sites exposing the wpmem_login_link shortcode to contributor-or-higher authors
WordPress installations that permit untrusted contributor accounts

Discovery Timeline

2025-07-22 - CVE-2025-7495 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7495

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under CWE-79. The wpmem_login_link shortcode accepts attributes from post or page content and renders them without sufficient escaping. A contributor who embeds the shortcode with crafted attribute values can inject HTML and JavaScript into the generated markup.

Because the payload is persisted inside post content, it executes every time the page loads. Exploitation requires an authenticated session with contributor privileges, which many WordPress sites grant to guest authors. The scope impact is changed, meaning the injected script runs in the trust context of the WordPress site and affects other users, including administrators who review submitted content.

Successful exploitation enables session hijacking through cookie theft, administrative account takeover via forced actions, redirection to malicious domains, and defacement of rendered content. See the Wordfence Vulnerability Report for the full disclosure.

Root Cause

The plugin fails to sanitize shortcode attributes before placing them into HTML output. The relevant handlers in class-wp-members-shortcodes.php, api.php, and the bundled utilities.php build link markup from attributes without applying WordPress escaping functions such as esc_attr() or esc_url() on all user-controlled values.

Attack Vector

An attacker authenticates to the WordPress site as a contributor or higher. The attacker creates or edits a post containing a wpmem_login_link shortcode with a malicious attribute value carrying a JavaScript payload. When any visitor renders the page, the browser parses and executes the injected script. Review workflows where administrators preview contributor drafts expand the blast radius to high-privilege accounts.

The vulnerability mechanism is described in prose only; no verified public exploit code is available. See the plugin changeset for the vendor fix diff.

Detection Methods for CVE-2025-7495

Indicators of Compromise

Posts, pages, or revisions containing wpmem_login_link shortcodes with attribute values that include <script>, javascript:, onerror=, onload=, or encoded equivalents.
Unexpected outbound requests from site visitors to attacker-controlled domains originating from rendered post content.
New or modified administrator accounts following contributor publishing activity.

Detection Strategies

Query the wp_posts table for post_content matching the wpmem_login_link shortcode and inspect attribute values for script syntax or URL schemes other than http, https, or mailto.
Monitor web server access logs for responses containing injected script indicators tied to pages authored by contributor accounts.
Review browser-side telemetry and Content Security Policy (CSP) violation reports for script execution anomalies on member-area pages.

Monitoring Recommendations

Alert on contributor or author role users publishing content that includes shortcode attributes with HTML or URL-scheme values.
Track plugin version inventory across managed WordPress estates and flag any installation at 3.5.4.1 or earlier.
Correlate administrative session anomalies, such as unexpected password or role changes, with recent contributor post edits.

How to Mitigate CVE-2025-7495

Immediate Actions Required

Update the WP-Members Membership Plugin to the version released after 3.5.4.1 that addresses CVE-2025-7495.
Audit all posts and pages for existing wpmem_login_link shortcodes and remove any malicious attribute content.
Review contributor and author accounts, revoke untrusted access, and rotate credentials for administrators who may have previewed injected content.

Patch Information

The plugin maintainer committed a fix tracked in the WordPress plugin changeset 3331571. Administrators should upgrade through the WordPress plugin management console or by replacing the plugin directory with the fixed release. Confirm the installed version in wp-admin after upgrading.

Workarounds

Restrict the contributor and author roles to trusted users until the patched plugin version is deployed.
Deploy a web application firewall (WAF) rule that blocks wpmem_login_link shortcode submissions containing <, >, javascript:, or on*= attribute patterns.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin to limit payload execution.

bash

# Configuration example: locate vulnerable shortcode usage in the database
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%wpmem_login_link%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%javascript:%' \
       OR post_content REGEXP 'on[a-z]+=');"

# Upgrade the plugin to the patched release
wp plugin update wp-members