WordPress Simple Membership WP user Import Plugin <= 1.7 is vulnerable to SQL Injection

Software Simple Membership WP user Import Type Plugin Vulnerable versions = 1.7 Fixed in 1.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0254 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 22216492afda Credits Etan Imanol Castro Aldrete Required...

PT-2023-16114 · WordPress · Simple Membership Wp User Import

Name of the Vulnerable Software and Affected Versions: Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7 Description: The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables...

Simple Membership < 4.2.2 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin. PoC 1. Exploit...

CVE-2022-2317

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter...

CVE-2022-2317

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter...

CVE-2022-2273

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

Design/Logic Flaw

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter...

CVE-2022-2317

CVE-2022-2317 affects the WordPress plugin Simple Membership (versions before 4.1.3). The root cause is insufficient validation of a user-supplied parameter during registration, allowing an unauthenticated user to elevate membership privileges by manipulating the level_identifier value (as demons...

CVE-2022-2273 Simple Membership < 4.1.3 - Membership Privilege Escalation

The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membershiplevel parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request...

WordPress plugin Simple Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Simple Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2022-15649 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue arises from improper validation of the membership level parameter when editing a profile. This allows members to potentially escalate to a higher membership lev...

PT-2022-15896 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.1.3 Description: The issue allows a user to change their membership at the registration stage due to insufficient checking of a user-supplied parameter. Recommendations: For versions prio...

WordPress Simple Membership plugin <= 4.1.2 - Membership Privilege Escalation vulnerability

Membership Privilege Escalation vulnerability discovered by Jet Infosystems in WordPress Simple Membership plugin versions = 4.1.2. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.3...

WordPress Simple Membership plugin <= 4.1.2 - Unauthenticated Membership Privilege Escalation vulnerability

Unauthenticated Membership Privilege Escalation vulnerability discovered by Jet Infosystems in WordPress Simple Membership plugin versions = 4.1.2. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.3...

CVE-2022-1724

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting...

CVE-2022-1724

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting...

CVE-2022-1724

The CVE-2022-1724 entry concerns the WordPress Simple Membership plugin (versions prior to 4.1.1). The issue is a reflected Cross-Site Scripting vulnerability in which parameters are not properly sanitized/escaped before being echoed in AJAX actions, enabling injection of malicious scripts when a...

WordPress plugin Simple Membership 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress Simple Membership plugin prior to...

WordPress Simple Membership plugin <= 4.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by cydave in WordPress Simple Membership plugin versions = 4.1.0. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.1...