Stored Cross-Site Scripting in Simple Membership Plugin for WordPress

CVE-2024-1985

What is CVE-2024-1985?

The Simple Membership plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'Display Name' parameter. This flaw exists in all versions up to and including 4.4.2, primarily due to inadequate input sanitization and output escaping. An unauthenticated attacker can exploit this vulnerability to inject arbitrary web scripts that execute when a user accesses an affected page. Although the risk is mitigated by the need for social engineering to trick users into interacting with the compromised functionality, it's crucial for site administrators to apply security best practices to mitigate potential exploitation.

References