CVE-2024-5075

The CVE is for the WordPress plugin WP eMember prior to version 10.6.6 . The issue is a Reflected XSS caused by failing to properly sanitize and escape a parameter before echoing it on the page. This could be leveraged against high-privilege users (e.g., admins). The available connected sources c...

CVE-2024-5080

The wp-eMember WordPress plugin is affected. Versions prior to 10.6.6 do not validate uploaded files, potentially allowing administrators to upload arbitrary files (including PHP) to the server. This is documented across multiple sources (Red Hat, Patchstack, PT-Security, and related CVE records)...

CVE-2024-5077

The CVE-2024-5077 entry concerns the wp-eMember WordPress plugin prior to 10.6.6, which lacks CSRF checks in certain areas and is missing sanitisation and escaping. This could allow a logged-in admin to inject Stored XSS payloads via a CSRF attack. Affected software: wp-eMember

CVE-2024-5744

CVE-2024-5744 affects the WordPress plugin WP eMember prior to version 10.6.7, where $_SERVER['REQUEST_URI'] is not escaped before echoing into an attribute, enabling Reflected XSS in older browsers. Public data from NVD/Red Hat Patch notes confirms the issue and indicates a fix in version 10.6.7...

CVE-2024-5715

CVE-2024-5715 affects the wp-eMember WordPress plugin prior to version 10.6.7. The issue is a Reflected Cross-Site Scripting vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed back in the page, which can be exploited against high-privilege users such as ...

CVE-2024-5074

The CVE-2024-5074 entry concerns the WordPress WP eMember plugin (versions prior to 10.6.6). The issue is a failure to sanitise/escape a parameter before echoing it, causing a Reflected Cross-Site Scripting vulnerability that could be exploited against high-privilege users (e.g., admins). The Red...

CVE-2024-5079

The CVE-2024-5079 entry affects the WordPress plugin wp-eMember (pre-10.6.7). The vulnerability stems from lack of sanitization/escaping of certain fields during member registration, enabling unauthenticated Stored XSS. Impact described as stored XSS with unauthenticated access; affected componen...

CVE-2024-5081

CVE-2024-5081 affects the WordPress plugin WP eMember , specifically versions prior to 10.7.0. The Red Hat advisory and NVD/NVD-derived entries state the vulnerability arises from lack of CSRF checks in some areas and missing sanitization/escaping, allowing a logged-in administrator to store Stor...

CVE-2024-5076

CVE-2024-5076 concerns the WordPress plugin wp-eMember prior to version 10.6.6 . Multiple connected sources confirm a lack of CSRF checks in certain areas, potentially allowing an attacker to trigger unwanted actions by tricking a logged-in user via CSRF attacks. The identified impact is high, wi...

CVE-2024-4749

The CVE-2024-4749 entry concerns the WP eMember WordPress plugin (versions before 10.3.9). The vulnerability is a Reflected XSS due to the fieldId parameter not being sanitized/escaped before echo, potentially enabling script injection in output pages. Public details confirm affected software and...