WordPress Plugin Vulnerabilities

WP eMember < 10.3.9 - Reflected XSS

Description

The plugin does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

Proof of Concept

Affects Plugins

Plugin icon
wp-eMember
Fixed in 10.3.9

References

CVE
CVE-2024-4749

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
kauenavarro
Submitter
kauenavarro
Submitter twitter
kauenavarroBR
Verified
Yes
WPVDB ID
6cc05a33-6592-4d35-8e66-9b6a9884df7e

Timeline

Publicly Published
2024-05-14 (about 1 year ago)
Added
2024-05-14 (about 1 year ago)
Last Updated
2024-05-14 (about 1 year ago)

Other

Published
Title
Published
2022-11-30
Title
1app Business Forms <= 1.0.0 - Author+ Stored XSS
Published
2011-11-20
Title
WP-Cumulus - Cross Site Scripting Vulnerabily
Published
2022-09-15
Title
Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSS
Published
2025-10-21
Title
WP-Thumbnail <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-04-10
Title
Product Excel Import Export & Bulk Edit for WooCommerce <= 4.7 - Reflected Cross-Site Scripting