CVE-2022-1903

CVE-2022-1903 affects the ARMember WordPress plugin (versions before 3.4.8). The underlying issue is missing nonce and authorization checks in an AJAX action accessible to unauthenticated users, enabling an attacker to change the password of arbitrary usernames and take over accounts (potentially...

CVE-2023-3996

CVE-2023-3996 affects the WordPress plugin “ARMember Lite – Membership”. The vulnerability is a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in admin settings. It requires authenticated attackers with administrator-level permissions (and above) to inject ...

CVE-2022-42888

ARMember premium plugin for WordPress (versions

CVE-2022-47421

CVE-2022-47421: Auth. (admin+) Stored Cross-Site Scripting in Repute InfoSystems ARMember (free) and ARMember (premium) WordPress plugins. Administrative users can inject stored XSS via input in ARMember settings/messages; impact per sources includes confidentiality/integrity exposure with potent...

CVE-2023-3011

CVE-2023-3011 affects the WordPress ARMember plugin (up to version 4.0.5). The vulnerability is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the arm_check_user_cap function, enabling unauthenticated attackers to trigger unauthorized actions if a site administrat...