The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and including, 1.11.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note - the issue was partially patched in 1.11.25, but could still potentially be exploited under some circumstances.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-17166 | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and including, 1.11.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note - the issue was partially patched in 1.11.25, but could still potentially be exploited under some circumstances. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 22 Jan 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Caseproof
Caseproof memberpress |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:caseproof:memberpress:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Caseproof
Caseproof memberpress |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2024-08-01T18:40:21.124Z
Reserved: 2024-02-09T17:48:46.821Z
Link: CVE-2024-1412
Vulnrichment
Updated: 2024-08-01T18:40:21.124Z
NVD
Status : Analyzed
Published: 2024-04-09T19:15:16.860
Modified: 2025-01-22T17:30:55.463
Link: CVE-2024-1412
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses