Wpcom

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Wpcom records in CISA KEV

No Wpcom vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wpcom Member 3 records MEDIUM

Records

3 records in Wpcom Member · all components

TI-2024-06943 CVE-2024-7493 · GHSA-qcf5-7mv4-v635

WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

MEDIUM 50

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00565 Published 2024-09-06 No fix listed CWE-269

TI-2025-01950 CVE-2025-2221 · GHSA-938x-rjx9-c9f3

WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

MEDIUM 42

The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and l…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0174 Published 2025-03-14 No fix listed CWE-89

TI-2024-31696 CVE-2024-47378 · GHSA-2x4p-3235-5xfj

WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lomu WPCOM Member wpcom-member allows Reflected XSS.This issue affects WPCOM Member: from n/a through <= 1.5.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00327 Published 2024-10-05 No fix listed CWE-79

Open these records in search →

Critical	1
High	2
Medium	0
Low	0
No CVSS	0