CVE-2024-5075

The CVE is for the WordPress plugin WP eMember prior to version 10.6.6 . The issue is a Reflected XSS caused by failing to properly sanitize and escape a parameter before echoing it on the page. This could be leveraged against high-privilege users (e.g., admins). The available connected sources c...

CVE-2024-5080

The wp-eMember WordPress plugin, in versions prior to 10.6.6 , is vulnerable to an arbitrary file upload flaw due to a lack of proper file validation. This oversight could allow users with admin privileges to upload unauthorized files, such as PHP scripts , directly onto the server. To remediate ...

CVE-2024-5081

The wp-eMember WordPress plugin (versions prior to v10.7.0 ) is vulnerable to a Stored XSS vulnerability via a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in specific areas, combined with missing sanitization and escaping of user-entered data. This could allo...

CVE-2024-5076

The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

CVE-2024-5077

The wp-eMember WordPress plugin in versions prior to 10.6.6 is vulnerable to a Stored XSS flaw. The root cause is a lack of CSRF checks in certain areas combined with missing sanitization and escaping . This allows an attacker to perform a CSRF attack to force a logged-in administrator to add Sto...

CVE-2024-5715

CVE-2024-5715 affects the wp-eMember WordPress plugin prior to version 10.6.7. The issue is a Reflected Cross-Site Scripting vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed back in the page, which can be exploited against high-privilege users such as ...

CVE-2024-5074

The wp-eMember WordPress plugin versions prior to 10.6.6 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This vulnerability could be leveraged to target high-privilege u...

CVE-2024-5744

The wp-eMember WordPress plugin (versions prior to 10.6.7 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly escape the $_SERVER['REQUEST_URI'] parameter before outputting it back within an attribute. This flaw could allow an attacker to execute ma...

CVE-2024-5079

The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register, which allows unauthenticated users to perform Stored Cross-Site Scripting attacks

CVE-2024-4749

The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.