Stored Cross-Site Scripting Vulnerability Affects WordPress Membership Plugin

CVE-2024-1852

Summary

The WP-Members Membership Plugin for WordPress is affected by a vulnerability that enables Stored Cross-Site Scripting (XSS) via the X-Forwarded-For header. This flaw arises from inadequate input sanitization and output escaping in all versions up to and including 3.4.9.2. Unsanctioned attackers can exploit this vulnerability to inject malicious web scripts within the edit users page, leading to potential execution whenever a legitimate user accesses the compromised page. A partial fix was applied in version 3.4.9.2, while version 3.4.9.3 includes a complete resolution to this security issue.

References