Non notée
CVE-2021-24979 The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an…
Description
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Paid Memberships Pro 2.6 | premières → < 2.6.6 | 2.6.6 |
Références
- wpscan.com wpscan.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Paid Memberships Pro
Les 5 CVE de Paid Memberships Pro →
CVE-2024-1279
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from…
4.3
Moyenne
CVE-2023-0631
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that…
Non notée
CVE-2022-4830
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes…
6.1
Moyenne
CVE-2021-25114
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route…
Non notée