10 matches found
CVE-2024-5075
The wp-eMember WordPress plugin versions prior to 10.6.6 are vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape a parameter before it is outputted back onto the page. This flaw could be exploited to target high-privile...
CVE-2024-5080
The wp-eMember WordPress plugin (versions prior to 10.6.6 ) is vulnerable to an arbitrary file upload vulnerability due to a failure to validate files during the upload process. This flaw allows administrators to upload arbitrary files, such as PHP scripts, onto the server. To mitigate this risk,...
CVE-2024-5081
The wp-eMember WordPress plugin, in versions prior to v10.7.0 , is vulnerable to a Stored XSS attack via Cross-Site Request Forgery (CSRF) . The root cause is a lack of CSRF checks in certain areas, combined with insufficient sanitization and escaping of user-provided data. This flaw could allow ...
CVE-2024-5077
The wp-eMember WordPress plugin (versions prior to 10.6.6 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to insufficient CSRF checks and a lack of proper sanitization and escaping in certain areas. This flaw could enable an attacker to trick a logged-in administrator into perfo...
CVE-2024-5076
The wp-eMember WordPress plugin, in versions prior to 10.6.6 , is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of proper CSRF checks in certain areas. This flaw allows an attacker to trick a logged-in user into performing unintended actions, such as a Bulk Delete operation. To re...
CVE-2024-5715
The wp-eMember WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 10.6.7 . The root cause is the failure to properly sanitize and escape a parameter before it is outputted back onto the page. This vulnerability specifically affects the Member Edit function...
CVE-2024-5074
The wp-eMember WordPress plugin versions prior to 10.6.6 are vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This flaw could be exploited to target high-privilege u...
CVE-2024-5079
The wp-eMember WordPress plugin versions prior to 10.6.7 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitise and escape certain fields provided during the member registration process. This flaw allows unauthenticated users to inject malicious scripts that...