WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)
CVE-2022-47140

7.1HIGH

Key Information:

Vendor
WordPress
Status
Armember
Vendor
CVE Published:
12 June 2023

Summary

The ARMember plugin for WordPress is vulnerable to an unauthenticated reflected cross-site scripting (XSS) attack, allowing attackers to inject malicious scripts through user inputs. This vulnerability affects versions equal to or lower than 4.0.1, enabling exploitation without user authentication, potentially compromising the security of the site's users and data.

Affected Version(s)

ARMember <= 4.0.1

References

https://patchstack.com/database/vulnerability/armember-me...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TEAM WEBoB of BoB 11th (Patchstack Alliance)
.