Stored Cross-Site Scripting Vulnerability in ARMember Lite Membership Plugin for WordPress
CVE-2023-3996

4.4MEDIUM

Key Information:

Vendor: WordPress
Status: Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup
Vendor: CVE Published:; 20 October 2023

What is CVE-2023-3996?

The ARMember Lite Membership Plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) through improper input sanitization and output escaping in the admin settings. This flaw affects versions up to and including 4.0.14, and may allow authenticated attackers with administrator-level permissions to inject malicious scripts into pages. The risk is amplified in multi-site installations and in setups where the 'unfiltered_html' capability is disabled, leading to potential exploitation when authorized users access compromised pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup * <= 4.0.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.svn.wordpress.org/armember-membership/tag...

CVSS V3.1

Score:

4.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

High

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Oct 20, 2023
Vulnerability Reserved
Jul 28, 2023

Credit

Marco Wotschka

JSON

WordPress