Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin = 3.2.7 versions...

CVE-2023-47668

The CVE concerns the StellarWP Membership Plugin – Restrict Content, affecting versions ≤ 3.2.7. The root cause is exposure of sensitive information to an unauthorised actor via the plugin’s legacy log mechanism (noted as legacy rcp-debug.log exposure). Practical impact is unauthenticated access ...

CVE-2023-47668 WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin = 3.2.7 versions...

CVE-2023-47668 WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin = 3.2.7 versions...

WordPress Plugin Membership Plugin - Restrict Content Information Disclosure Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Membership Plugin - Restri...

PT-2023-30553 · Unknown · Restrict Content +1

Name of the Vulnerable Software and Affected Versions: StellarWP Membership Plugin - Restrict Content plugin versions = 3.2.7 Description: The issue concerns exposure of sensitive information to unauthorized actors. Recommendations: For versions = 3.2.7, update to a version higher than 3.2.7 to...

CVE-2023-3996

CVE-2023-3996 affects the WordPress plugin “ARMember Lite – Membership”. The vulnerability is a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in admin settings. It requires authenticated attackers with administrator-level permissions (and above) to inject ...

Simple Membership Plugin For WordPress < 4.3.5 Multiple Vulnerabilities

The WordPress Simple Member Plugin installed on the remote host is affected by multiple vulnerabilities as follows. - A Account Takeover Vulnerability due to missing input validation on the processpasswordresetusinglink function which permits authenticated attackers to gain access to arbitrary...

Simple Membership Plugin For WordPress < 4.1.3 Multiple Vulnerabilities

The WordPress Simple Member Plugin installed on the remote host is affected by multiple vulnerabilities as follows: - A privilege escalation flaw due to insufficient validation on the membership levelidentifier supplied, which permits unauthenticated attackers to supply arbitrary membership level...

Simple Membership Plugin For WordPress < 4.1.1 Reflected Cross-Site Scripting

The WordPress Simple Member Plugin installed on the remote host is affected by a reflected Cross-Site scripting vulnerability due to improper sanitisation of parameters before outputting them as AJAX actions. Note that the scanner has not tested for these issues but has instead relied only on the...

CVE-2023-4719

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the listtype parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web...

Cross site scripting

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the listtype parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web...

WordPress Restrict User Access – Membership Plugin with Force Plugin < 2.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Restrict User Access – Membership Plugin with Force Type Plugin Vulnerable versions 2.4.3 Fixed in 2.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer DEV Institute PSID d12efa624193 Credits...

CVE-2023-3182

The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3182 Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS

The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Membership Plugin - Restrict Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869

CVE-2023-2869 concerns the WordPress WP-Members Membership plugin. The vulnerability arises from a missing capability check in the do_field_reorder function, allowing authenticated users with subscriber-level access to reorder form elements on login forms and thereby perform unauthorized updates ...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...