CVE-2023-3996

CVE-2023-3996 affects the WordPress plugin “ARMember Lite – Membership”. The vulnerability is a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in admin settings. It requires authenticated attackers with administrator-level permissions (and above) to inject ...

CVE-2023-3996: Improper Neutralization of Input During Web Page Generation

The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

Simple Membership Plugin For WordPress < 4.3.5 Multiple Vulnerabilities

The WordPress Simple Member Plugin installed on the remote host is affected by multiple vulnerabilities as follows. - A Account Takeover Vulnerability due to missing input validation on the processpasswordresetusinglink function which permits authenticated attackers to gain access to arbitrary...

Simple Membership Plugin For WordPress < 4.1.3 Multiple Vulnerabilities

The WordPress Simple Member Plugin installed on the remote host is affected by multiple vulnerabilities as follows: - A privilege escalation flaw due to insufficient validation on the membership levelidentifier supplied, which permits unauthenticated attackers to supply arbitrary membership level...

Simple Membership Plugin For WordPress < 4.1.1 Reflected Cross-Site Scripting

The WordPress Simple Member Plugin installed on the remote host is affected by a reflected Cross-Site scripting vulnerability due to improper sanitisation of parameters before outputting them as AJAX actions. Note that the scanner has not tested for these issues but has instead relied only on the...

CVE-2023-4719

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the listtype parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web...

Cross site scripting

The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the listtype parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web...

WordPress Restrict User Access – Membership Plugin with Force Plugin < 2.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Restrict User Access – Membership Plugin with Force Type Plugin Vulnerable versions 2.4.3 Fixed in 2.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer DEV Institute PSID d12efa624193 Credits...

CVE-2023-3182

The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-3182 Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS

The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress plugin Membership Plugin - Restrict Content 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869

CVE-2023-2869 concerns the WordPress WP-Members Membership plugin. The vulnerability arises from a missing capability check in the do_field_reorder function, allowing authenticated users with subscriber-level access to reorder form elements on login forms and thereby perform unauthorized updates ...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged-in admin open a page containing the HTML code below. "/...

CVE-2023-23820

The CVE-2023-23820 entry concerns the WordPress ProfilePress Plugin (Membership Team) versions &lt;= 4.5.4. The vulnerability is a stored XSS that requires authentication (contributors or higher) to exploit. The available documents specify the issue as an Auth. (contributor+) Stored Cross-Site Sc...

VulnCheck KEV: CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

CVE-2022-4939

THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wpajaxnoprivwcfmajaxcontroller AJAX action that controls membership settings. This makes it possible for unauthenticated attackers to...

CVE-2022-4941

The WCFM Membership plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.10 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership...