WordPress Plugin Vulnerabilities

ARMember (free and premium) - Admin+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some parameters, which could allow users with a role of Admin and above to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
armember-membership
Fixed in 4.0.5
Plugin icon
armember-membership-premium
No known fix

References

CVE
CVE-2022-47421

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Cat
Verified
No
WPVDB ID
614252b7-28fd-4953-a5ec-d9118e42bcf5

Timeline

Publicly Published
2023-07-18 (about 2 years ago)
Added
2023-07-20 (about 2 years ago)
Last Updated
2023-07-20 (about 2 years ago)

Other

Published
Title
Published
2024-12-11
Title
Library Bookshelves < 5.9 - Reflected Cross-Site Scripting
Published
2025-06-05
Title
ShiftNav – Responsive Mobile Menu < 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-02-23
Title
WP Responsive Auto Fit Text < 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-20
Title
Shortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-12-02
Title
WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout < 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting