Plugin icon

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

armember-membership
Plugin closed

Vulnerabilities:

18

Last Updated:

February 1, 2025

Active Installs:

9000

Published
Title
Fixed in
CVSS
Published
2024-12-05
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.52 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Fixed in
Fixed in 4.0.52
CVSS
6.3 (medium)
Published
2024-08-16
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.38 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
Fixed in
Fixed in 4.0.38
CVSS
6.4 (medium)
Published
2024-04-29
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.31 - Open Redirect
Fixed in
Fixed in 4.0.31
CVSS
6.1 (medium)
Published
2024-04-22
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.29 - Missing Authorization
Fixed in
Fixed in 4.0.29
CVSS
5.3 (medium)
Published
2024-04-04
Title
ARMember < 4.0.28 - Directory Traversal via X-FILENAME
Fixed in
Fixed in 4.0.28
CVSS
5.3 (medium)
Published
2024-03-26
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.27 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 4.0.27
CVSS
9.8 (critical)
Published
2024-03-26
Title
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.27 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.0.27
CVSS
9.8 (critical)
Published
2024-03-15
Title
ARMember < 4.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.24
CVSS
4.4 (medium)
Published
2024-02-01
Title
ARMember < 4.0.25 - Improper Access Control to Sensitive Information Exposure via REST API
Fixed in
Fixed in 4.0.25
CVSS
5.3 (medium)
Published
2024-01-11
Title
ARMember < 4.0.23 - Cross-Site Request Forgery
Fixed in
Fixed in 4.0.23
CVSS
6.3 (medium)
Published
2023-12-26
Title
ARMember < 4.0.11 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 4.0.11
CVSS
8.8 (high)
Published
2023-07-18
Title
ARMember (free and premium) - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.5
CVSS
3.5 (low)
Published
2023-07-14
Title
ARMember Lite - Membership < 4.0.17 - Admin+ Stored XSS
Fixed in
Fixed in 4.0.17
CVSS
4.4 (medium)
Published
2023-07-05
Title
ARMember < 4.0.6 - ARMember Cross-Site Request Forgery
Fixed in
Fixed in 4.0.6
CVSS
6.5 (medium)
Published
2023-06-13
Title
ARMember < 4.0.3 - Admin+ Stored XSS
Fixed in
Fixed in 4.0.3
CVSS
3.5 (low)
Published
2023-04-19
Title
ARMember < 4.0.2 - Reflected XSS
Fixed in
Fixed in 4.0.2
CVSS
7.1 (high)
Published
2023-03-27
Title
ARMember < 4.0 - Unauthenticated SQLi
Fixed in
Fixed in 4.0
CVSS
8.6 (high)
Published
2022-06-06
Title
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
Fixed in
Fixed in 3.4.8
CVSS
10.0 (critical)