CVE-2024-2920 WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for...

CVE-2024-2920

The CVE-2024-2920 entry concerns the WP-Members Membership Plugin for WordPress, with Information Exposure affecting all versions up to 3.4.9.3. The root cause is that user-uploaded files are placed in a publicly accessible directory under wp-content, allowing unauthenticated attackers to view fi...

CVE-2024-2920 WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for...

WordPress WP-Members Membership Plugin plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files vulnerability

Unprotected Storage of Potentially Sensitive Files vulnerability discovered by Tim Coen in WordPress Plugin WP-Members versions = 3.4.9.3...

PT-2024-22802 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.9.3 Description: The issue allows unauthenticated attackers to view files uploaded by other users, which may contain sensitive information, due to the plugin uploading...

WordPress WP-Members Plugin <= 3.4.9.3 is vulnerable to Sensitive Data Exposure

Software WP-Members Type Plugin Vulnerable versions = 3.4.9.3 Fixed in 3.4.9.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2920 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7f772dce8825 Credits Tim Coen Required privilege...

CVE-2024-1852 WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-1852 WP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

Critical Security Flaw Found in Popular LayerSlider WordPress Plugin

A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of SQL...

WordPress WP-Members Plugin <= 3.4.9.2 is vulnerable to Cross Site Scripting (XSS)

Software WP-Members Type Plugin Vulnerable versions = 3.4.9.2 Fixed in 3.4.9.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1852 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 145e334b433b Credits Webbernaut Required...

Cross site scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-1987

CVE-2024-1987 — WP-Members Membership Plugin (WordPress) is a stored XSS vulnerability in the plugin’s shortcode attributes, affecting all versions up to 3.4.9.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers wi...

CVE-2024-1987 WP-Members Membership Plugin <= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress WP-Members Plugin <= 3.4.9.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-Members Type Plugin Vulnerable versions = 3.4.9.1 Fixed in 3.4.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1987 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cb743b727613 Credits Sh Required privilege...

WP-Members Membership Plugin < 3.4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2023-6733

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmemfield shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data includin...

Design/Logic Flaw

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmemfield shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data includin...

CVE-2023-6733 WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmemfield shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data includin...

CVE-2023-6733

CVE-2023-6733 affects the WordPress plugin WP-Members Membership Plugin . Vulnerability: Sensitive Information Exposure via the shortcode wpmem_field in all versions up to 3.4.8. Impact: authenticated users with contributor access and above can exfiltrate sensitive data such as emails, password h...

CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...