CVE-2024-9231

🗓️ 22 Oct 2024 09:32:09Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 42 Views

The WP-Members Membership Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to add_query_arg without appropriate escaping on the URL

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-9231	22 Oct 202412:56	–	circl
CNNVD	WordPress plugin WP-Members Membership Plugin 跨站脚本漏洞	22 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9231 WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting	22 Oct 202409:32	–	cvelist
EUVD	EUVD-2024-49807	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9231	22 Oct 202410:15	–	nvd
OSV	CVE-2024-9231	22 Oct 202410:15	–	osv
Patchstack	WordPress WP-Members Membership Plugin plugin <= 3.4.9.5 - Reflected Cross-Site Scripting vulnerability	21 Oct 202421:10	–	patchstack
Patchstack	WordPress WP-Members Plugin <= 3.4.9.5 is vulnerable to Cross Site Scripting (XSS)	21 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39507 · WordPress · Wp-Members Membership Plugin	22 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9231	23 May 202508:15	–	redhatcve

NVD

Vulners

Node

butlerblog wp-membersRange<3.4.9.6wordpress

[
  {
    "vendor": "cbutlerjr",
    "product": "WP-Members Membership Plugin",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.4.9.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3172354/wp-members/trunk/includes/class-wp-members-forms.php
plugins	www.plugins.trac.wordpress.org/browser/wp-members/tags/3.4.9.5/includes/class-wp-members.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2d59e599-59da-4c03-b71f-d00a078b2442
plugins	www.plugins.trac.wordpress.org/browser/wp-members/tags/3.4.9.5/includes/class-wp-members-forms.php

08 Apr 2026 16:44Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.1

EPSS0.02566

SSVC

CWE-79