Skip to content
Sign in
6.8 Medium

CVE-2024-5077 The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as…

Description

The wp-eMember WordPress plugin before 10.6.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affected products and versions

Product Affected versions Fixed in
wp-eMember 10.6 earliest → < 10.6.6 10.6.6
wp_emember 10.6 earliest → < 10.6.6 10.6.6

Other CVEs of wp-eMember

The 10 CVEs of wp-eMember →
CVE-2024-5081 The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as… 6.1 Medium CVE-2024-5744 The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it… 6.8 Medium CVE-2024-5715 The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in… 7.1 High CVE-2024-5079 The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape some of the fields when members register,… 6.1 Medium
Track this CVE