Stored Cross-Site Scripting in Paid Membership Plugin for WordPress by ProfilePress
CVE-2024-1409
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 13 March 2024
What is CVE-2024-1409?
The Paid Membership Plugin for WordPress, developed by ProfilePress, is exposed to a Stored Cross-Site Scripting vulnerability through its [reg-select-role] shortcode. This vulnerability affects all plugin versions up to and including 4.15.0, where inadequate input sanitization and output escaping on user-supplied attributes allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts. These scripts execute when any user accesses a compromised page, potentially compromising user data and application security.
Affected Version(s)
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress * <= 4.15.0