CVE-2025-14448 is a stored cross-site scripting vulnerability (CWE-79) in the WP-Members Membership Plugin for WordPress, affecting all versions up to 3.5.4.3. The issue is due to improper neutralization of input during web page generation, specifically in the Multiple Checkbox and Multiple Select user profile fields. Authenticated attackers with at least Subscriber-level privileges can inject malicious scripts that execute in the context of other users viewing the injected content. This vulnerability can lead to limited confidentiality and integrity impacts, but no availability impact is noted. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope changed.

An attacker with authenticated access at Subscriber level or above can inject stored malicious scripts via user profile fields. These scripts execute when other users access the affected pages, potentially allowing the attacker to steal session tokens, perform actions on behalf of other users, or manipulate displayed content. The impact is limited to confidentiality and integrity, with no direct availability impact reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting user input in the affected fields or limiting Subscriber-level user capabilities as a temporary mitigation.