Reflected XSS Vulnerability in DEV Institute's Membership Plugin
CVE-2024-29138

7.1HIGH

Key Information:

Vendor

WordPress
Status
Restrict User Access – Membership Plugin With Force
Vendor
CVE Published:
19 March 2024

What is CVE-2024-29138?

A reflected XSS vulnerability exists in DEV Institute's Restrict User Access – Membership Plugin with Force, allowing attackers to inject malicious scripts via reflective web page generation. This issue can lead to unauthorized actions on behalf of users and expose sensitive information. Users of affected versions, specifically from n/a through 2.5, should take immediate steps to apply relevant security patches to mitigate potential exploitation.

Affected Version(s)

Restrict User Access – Membership Plugin with Force 0 <= 2.5

References

https://patchstack.com/database/Wordpress/Plugin/restrict...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.