WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Ultimate Membership Pro versions = 12.7...

WordPress Opal Membership plugin <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Karolina Jankowska in WordPress Plugin Opal Membership versions = 1.2.4...

WordPress Opal Membership plugin <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure vulnerability

Authenticated Subscriber+ Information Disclosure vulnerability discovered by Karolina Jankowska in WordPress Plugin Opal Membership versions = 1.2.4...

WordPress plugin Opal Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43241 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 75c4d13f2043 Credits Rafie Muhammad Patchstack...

WordPress Opal Membership Plugin <= 1.2.4 is vulnerable to Sensitive Data Exposure

Software Opal Membership Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7648 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 214acb8454b5 Credits Karolina Jankowska Required...

WordPress Opal Membership Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Opal Membership Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7649 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6b301b87dfe8 Credits Karolina Jankowska...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to PHP Object Injection

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-43242 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 4d478cf8c35d Credits Rafie Muhammad Patchstack Required...

PT-2024-7360 · Unknown · Ultimate Membership Pro

Name of the Vulnerable Software and Affected Versions: Ultimate Membership Pro versions n/a through 12.6 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remote attacker to execute arbitrary code. The...

WordPress plugin Opal Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to Privilege Escalation

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-43240 Patch priority High CVSS severity High 9.4 Developer Claim ownership PSID cfa9ba3d1675 Credits...

PT-2024-7361 · WordPress · Ultimate Membership Pro

Name of the Vulnerable Software and Affected Versions: Ultimate Membership Pro versions through 12.6 Description: The issue is related to improper privilege management in the Ultimate Membership Pro plugin for WordPress, which can allow an attacker to escalate their privileges. Recommendations: F...

Kashipara Live Membership System 安全漏洞

Kashipara Live Membership System is a live membership system from Kashipara Inc. A security vulnerability exists in Kashipara Live Membership System version v1.0, which originates from a SQL injection vulnerability in /index.php...

Live Membership System 安全漏洞

Live Membership System is a live membership system by rashmi mishra individual developer. A security vulnerability exists in Live Membership System version v1.0, which stems from an unrestricted file upload vulnerability found in /Membership/editmember.php...

Live Membership System 安全漏洞

Live Membership System is a live membership system by rashmi mishra individual developer. A security vulnerability exists in Live Membership System v1.0, which stems from a cross-site request forgery CSRF vulnerability found in /deletemembers.php...

Live Membership System 安全漏洞

Live Membership System is a live membership system by rashmi mishra individual developer. A security vulnerability exists in Live Membership System v1.0, which stems from a stored cross-site scripting XSS vulnerability found in /viewtype.php...

CVE-2024-7649 Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting

The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-7649 Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting

The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-7649

CVE-2024-7649 (Opal Membership, WordPress) : Stored XSS in checkout form fields across all versions up to and including 1.2.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers could inject scripts that run when users load injected pages. No public remediation d...

CVE-2024-7648 Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure

The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access...