CVE-2025-12018: MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12018?
CVE-2025-12018 is classified as a high-severity vulnerability due to the potential for stored cross-site scripting attacks affecting WordPress sites.
How do I fix CVE-2025-12018?
To fix CVE-2025-12018, update the MembershipWorks plugin for WordPress to version 6.15 or later, which addresses the vulnerability.
Who is affected by CVE-2025-12018?
CVE-2025-12018 affects users of the MembershipWorks – Membership, Events & Directory plugin for WordPress in all versions up to and including 6.14.
What type of vulnerability is CVE-2025-12018?
CVE-2025-12018 is a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the plugin.
What are the potential impacts of CVE-2025-12018?
The potential impacts of CVE-2025-12018 include unauthorized script execution in user sessions, leading to data theft or site defacement.