memberful membership plugin vulnerable to stored cross-site scripting

CVE-2024-9242

Summary

The Memberful Membership Plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that arises from insufficient input sanitization and output escaping on user-supplied attributes in the shortcodes 'memberful_buy_subscription_link' and 'memberful_podcasts_link'. This vulnerability affects all versions up to and including 1.73.7, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts will execute when users access the compromised pages, potentially compromising the security and integrity of user data.

References