CVE-2026-9273: Weak Password Recovery Mechanism for Forgotten Password

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

WordPress plugin CRM Memberships 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin SUMO Memberships for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-9048

The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delimgajaxcall function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-9048 Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion

The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delimgajaxcall function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

WordPress Wptobe-memberships plugin <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Aril Aprilio forsak3n in WordPress Plugin Wptobe-memberships versions = 3.4.2...

CVE-2023-27427

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NTZApps CRM Memberships plugin = 1.6 versions...

WordPress Paid Membership Subscriptions plugin <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Paid Member Subscriptions versions = 2.13.4...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NTZApps CRM Memberships plugin = 1.6 versions...

CVE-2023-27427 WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NTZApps CRM Memberships plugin = 1.6 versions...

CVE-2023-27427 WordPress CRM Memberships Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in NTZApps CRM Memberships plugin = 1.6 versions...

WordPress CRM Memberships Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM Memberships Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27427 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 152ce6558832 Credits Pavitra Tiwari Required...