TI-2022-20884 CVE-2022-42888 · GHSA-7gxx-q4r2-6xhg
WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation
Priority MEDIUM 50
Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
Armemberplugin
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Armemberplugin records in CISA KEVNo Armemberplugin vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records in Armember · all components
TI-2022-01763 CVE-2022-1903 · GHSA-84p8-fx26-f9cw
ARMember < 3.4.8 - Unauthenticated Admin Account Takeover
Priority MEDIUM 47
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to c…
TI-2023-02819 CVE-2023-3011 · GHSA-985x-4r2c-5qx3
ARMember <= 4.0.5 - Cross-Site Request Forgery
Priority LOW 38
The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5.
TI-2022-23498 CVE-2022-47421 · GHSA-7475-2737-8cq2
WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)
Priority LOW 27
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
TI-2023-03710 CVE-2023-3996 · GHSA-364j-ch9m-hp4h
ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
Priority LOW 23
The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 due to insufficient input sanitization and output escaping.