Reflected Cross-Site Scripting Vulnerability in Simple Membership Plugin for WordPress

CVE-2023-6882

What is CVE-2023-6882?

The Simple Membership plugin for WordPress is susceptible to a Reflected Cross-Site Scripting (XSS) attack via the 'environment_mode' parameter. This flaw arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts into webpages. If users are tricked into clicking a malicious link, the injected scripts can execute in their browsers, potentially leading to unauthorized access to sensitive information or further exploitation of the site.

References