495 matches found
CVE-2018-10234
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-10234
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-10234
CVE-2018-10234: Authenticated Cross-Site Scripting in the WordPress User Profile & Membership plugin prior to 2.0.11, exploitable via the Account Deletion Custom Text field on wp-admin/admin.php?page=um_options§ion=account. Impact is XSS authenticated users; remediation is to update to 2.0.11...
Ultimate Member <= 2.0 - Multiple XSS
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple XSS security vulnerability...
WordPress membership-simplified-for-oap-members-only plugin arbitrary file download vulnerability
WordPress membership-simplified-for-oap-members-only is a membership plugin developed for WordPress. An arbitrary file download vulnerability exists in the WordPress membership-simplified-for-oap-members-only version 1.58 plugin, which stems from the program failing to detect whether a user is...
CVE-2017-1002008
Vulnerability in wordpress plugin membership-simplified-for-oap-members-only v1.58, The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privileges...
WordPress Training Membership 1.0.8 Cross Site Scripting Vulnerability
WordPress Fitness Trainer - Training Membership plugin versions 1.0.8 and below suffer from a cross site scripting vulnerability. Exploit Title: Wordpress Fitness Trainer - Training Membership Plugin ================== 8bitsec - https://twitter.com/8bitsec 0day.today 2018-04-09...
Membership Simplified <= 1.58 - Unauthenticated Arbitrary File Download
The plugin is still affected and has been closed...
Users Ultra Membership Plugin <= 1.5.62 - Authenticated Stored Cross-Site Scripting (XSS) & CSRF
Both pname and pdesc are vulnerable. No nonce on form so also vulnerable to CSRF. Original researcher's PoC does not work as all parameters are needed to be submitted not just the pname parameter...
CVE-2015-4038
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...
Code injection
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...
CVE-2015-4038
The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...
WordPress WP Membership Plugin Security Bypass Vulnerability
WordPress is a set of blogging platform developed using the PHP language, supporting personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress WP Membership plugin that allows remote attackers to exploit the vulnerability to bypass security restrictions a...
WordPress WP Membership 1.2.3 Privilege Escalation
Exploit Title: WordPress WP Membership plugin Privilege escalation Contact: https://twitter.com/panVagenas Vendor Homepage: http://wpmembership.e-plugins.com/ Software Link: http://codecanyon.net/item/wp-membership/10066554 Version: 1.2.3 Tested on: WordPress 4.2.2 CVE: CVE-2015-4038 1 Descriptio...
WordPress WP Membership Plugin 1.2.3 - Multiple Vulnerabilities
There are multiple vulnerabilities in this WordPress Membership plugin. 1. Privilege escalation. Because of this vulnerability, an attacker can take administrative role to the infected website via "ivmembershipupdateusersettings" AJAX action. 2. Stored XSS allows an attacker to login as regular...