CVE-2023-2869

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

CVE-2023-2869

CVE-2023-2869 concerns the WordPress WP-Members Membership plugin. The vulnerability arises from a missing capability check in the do_field_reorder function, allowing authenticated users with subscriber-level access to reorder form elements on login forms and thereby perform unauthorized updates ...

CVE-2023-2869 WP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings Update

The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...

WordPress wp-members plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-members is a website membership plugin used in it. Cross-site request forgery vulnerability exists in WordPress wp-member plugin...

CVE-2019-15660

The wp-members plugin before 3.2.8 for WordPress has CSRF...

CVE-2019-15660

The wp-members plugin before 3.2.8 for WordPress has CSRF...

Cross site request forgery (csrf)

The wp-members plugin before 3.2.8 for WordPress has CSRF...

CVE-2019-15660

The CVE-2019-15660 entry affects the WordPress wp-members plugin prior to 3.2.8, where a CSRF flaw is reported. Multiple sources (Red Hat, CNVD, CVE/NVD, OpenVAS, WPVulnDB) corroborate a CSRF risk in versions before 3.2.8. The vulnerability is described as CSRF without additional exploit details ...

PT-2019-14328 · WordPress · Wp-Members Plugin

Name of the Vulnerable Software and Affected Versions: wp-members plugin versions prior to 3.2.8 Description: The issue concerns a CSRF problem. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited...

WordPress WP-Members plugin <= 3.2.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by m0ns7er in WordPress WP-Members plugin versions = 3.2.7. Solution Update the WordPress WP-Members plugin to the latest available version at least 3.2.8.1...

WP-Members <= 3.2.7 - Cross-Site Request Forgery (CSRF)

No CSRF Protection on Add new Fields. Can also Edit and Delete fields the same way. PoC 1.Download csrfwp-members.html 2.Change URL in html file.FORM ACTION. 3.Submit Request. Video POC : https://drive.google.com/file/d/1TuJK0NjxznjTDmoJF5wbGu2vMAXXikw/view?usp=sharing HTMLFILE :...

WP-Members <= 3.2.7 - Cross-Site Request Forgery (CSRF)

No CSRF Protection on Add new Fields. Can also Edit and Delete fields the same way. 1.Download csrfwp-members.html 2.Change URL in html file.FORM ACTION. 3.Submit Request. Video POC : https://drive.google.com/file/d/1TuJK0NjxznjTDmoJF5wbGu2vMAXXikw/view?usp=sharing HTMLFILE :...

WP-Members <= 3.1.7 - Authenticated Cross-Site Scripting (XSS)

The WP-Members Membership Plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Cross site scripting

Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2222

Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2222

Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2222

CVE-2017-2222 describes an XSS vulnerability in the WordPress WP-Members plugin affecting versions prior to 3.1.8. The primary description notes arbitrary script injection via unspecified vectors. Related sources consistently indicate the fix is to update to version 3.1.8 or later; some entries a...

CVE-2017-2222

Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-15271 · WordPress · Wp-Members

Name of the Vulnerable Software and Affected Versions: WP-Members versions prior to 3.1.8 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations: For versions prior to 3.1.8, update to version 3.1.8 or late...