The WP-Members plugin for WordPress, developed by Chad Butler, contains a stored cross-site scripting vulnerability (CVE-2025-57973) due to improper input neutralization during web page generation. This flaw affects all versions up to 3.5.4.2. An attacker with low privileges can inject malicious scripts that are stored and later executed in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting medium severity with network attack vector, high attack complexity, low privileges required, and user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users visiting the affected site, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited to confidentiality, integrity, and availability at a low level. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization workarounds if feasible. Monitor official channels from Chad Butler or WP-Members for updates and apply patches promptly once released.