CVE-2024-7703

CVE-2024-7703 CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress Plugin,...

WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...

ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover even the administrator due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username. id:...

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Insecure Password Reset Mechanism → Full Admin Account Takeover Plaintext Password Reset Keys Stored in Database + SQL Injection = Complete Admin Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership...

CVE-2022-1903

CVE-2022-1903 Title: ARMember 3.4.8 - Unauthenticated Admin Account Takeover Author: Cyllective https://cyllective.com/ CVE: CVE-2022-1903 Installation git clone https://github.com/biulove0x/CVE-2022-1903.git cd CVE-2022-1903/ python3 -m pip install -r requirements.txt How to run autoexploit $...

CVE-2026-93427

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

CVE-2026-93427 ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

EUVD-2026-120826

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

CVE-2026-93427

The ARMember Premium plugin for WordPress (including Membership Plugin, Content Restriction, Member Levels, User Profile & User signup) is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.1 . The root cause is insufficient input sanitization and output escap...

WordPress Plugin: armember: CVE-2026-93427: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

CVE-2026-93427: armember: The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for…

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field Profile Cover in all versions up to, and including, 7.8.1 due to insufficient input sanitization...

WordPress ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Rafie Muhammad in WordPress Plugin ARMember Premium versions = 7.8.1...

VulnCheck KEV: CVE-2026-7649

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user supplied paramete...

PT-2026-141548

Name of the Vulnerable Software and Affected Versions ARMember Premium versions prior to 7.8.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the Registration Custom Field Profile Cover. This allows unauthenticated attackers to...

CVE-2026-42417

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

EUVD-2026-93054

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42417

The WordPress ARMember Premium plugin, version 7.8 and below , is vulnerable to an unauthenticated SQL Injection (CWE-89). This flaw allows an attacker to execute arbitrary SQL commands against the database. The vulnerability is categorized with a CRITICAL base severity score of 9.3 , indicating ...