CVE-2022-1903

The ARMember WordPress plugin (versions prior to 3.4.8 ) is vulnerable to unauthenticated account takeover , including administrator accounts. The root cause is a lack of nonce and authorization checks within an AJAX action accessible to unauthenticated users. This flaw allows an attacker to chan...

CVE-2022-47421

CVE-2022-47421: Auth. (admin+) Stored Cross-Site Scripting in Repute InfoSystems ARMember (free) and ARMember (premium) WordPress plugins. Administrative users can inject stored XSS via input in ARMember settings/messages; impact per sources includes confidentiality/integrity exposure with potent...

CVE-2023-3011

CVE-2023-3011 affects the WordPress ARMember plugin (up to version 4.0.5). The vulnerability is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the arm_check_user_cap function, enabling unauthenticated attackers to trigger unauthorized actions if a site administrat...