memberful membership plugin vulnerable to stored cross-site scripting

CVE-2024-9242

What is CVE-2024-9242?

The Memberful Membership Plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that arises from insufficient input sanitization and output escaping on user-supplied attributes in the shortcodes 'memberful_buy_subscription_link' and 'memberful_podcasts_link'. This vulnerability affects all versions up to and including 1.73.7, allowing authenticated attackers with contributor-level access or higher to inject malicious web scripts. These scripts will execute when users access the compromised pages, potentially compromising the security and integrity of user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References