Stored Cross-Site Scripting in Simple Membership Plugin for WordPress

CVE-2024-1985

What is CVE-2024-1985?

The Simple Membership plugin for WordPress is susceptible to Stored Cross-Site Scripting via the 'Display Name' parameter. This flaw exists in all versions up to and including 4.4.2, primarily due to inadequate input sanitization and output escaping. An unauthenticated attacker can exploit this vulnerability to inject arbitrary web scripts that execute when a user accesses an affected page. Although the risk is mitigated by the need for social engineering to trick users into interacting with the compromised functionality, it's crucial for site administrators to apply security best practices to mitigate potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References