10 matches found
CVE-2024-5075
The CVE is for the WordPress plugin WP eMember prior to version 10.6.6 . The issue is a Reflected XSS caused by failing to properly sanitize and escape a parameter before echoing it on the page. This could be leveraged against high-privilege users (e.g., admins). The available connected sources c...
CVE-2024-5080
The wp-eMember WordPress plugin, in versions prior to 10.6.6 , is vulnerable to an arbitrary file upload flaw due to a lack of proper file validation. This oversight could allow users with admin privileges to upload unauthorized files, such as PHP scripts , directly onto the server. To remediate ...
CVE-2024-5081
The wp-eMember WordPress plugin (versions prior to v10.7.0 ) is vulnerable to a Stored XSS vulnerability via a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in specific areas, combined with missing sanitization and escaping of user-entered data. This could allo...
CVE-2024-5076
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-5077
The wp-eMember WordPress plugin in versions prior to 10.6.6 is vulnerable to a Stored XSS flaw. The root cause is a lack of CSRF checks in certain areas combined with missing sanitization and escaping . This allows an attacker to perform a CSRF attack to force a logged-in administrator to add Sto...
CVE-2024-5715
CVE-2024-5715 affects the wp-eMember WordPress plugin prior to version 10.6.7. The issue is a Reflected Cross-Site Scripting vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed back in the page, which can be exploited against high-privilege users such as ...
CVE-2024-5074
The wp-eMember WordPress plugin versions prior to 10.6.6 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This vulnerability could be leveraged to target high-privilege u...
CVE-2024-5744
The wp-eMember WordPress plugin (versions prior to 10.6.7 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly escape the $_SERVER['REQUEST_URI'] parameter before outputting it back within an attribute. This flaw could allow an attacker to execute ma...