Stored Cross-Site Scripting Vulnerability in ARMember Lite Membership Plugin for WordPress
CVE-2023-3996

4.8MEDIUM

Key Information:

Vendor
Wordpress
Status
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Vendor
CVE Published:
20 October 2023

Summary

The ARMember Lite Membership Plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) through improper input sanitization and output escaping in the admin settings. This flaw affects versions up to and including 4.0.14, and may allow authenticated attackers with administrator-level permissions to inject malicious scripts into pages. The risk is amplified in multi-site installations and in setups where the 'unfiltered_html' capability is disabled, leading to potential exploitation when authorized users access compromised pages.

Affected Version(s)

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup * <= 4.0.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.svn.wordpress.org/armember-membership/tag...
https://plugins.svn.wordpress.org/armember-membership/tag...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.