Vulnerabilities

TI-2025-01950 CVE-2025-2221 · GHSA-938x-rjx9-c9f3

WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

MEDIUM 42

The WPCOM Member plugin for WordPress is vulnerable to time-based SQL Injection via the ‘user_phone’ parameter in all versions up to, and including, 1.7.6 due to insufficient escaping on the user supplied parameter and l…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0174 Published 2025-03-14 No fix listed CWE-89

TI-2024-31696 CVE-2024-47378 · GHSA-2x4p-3235-5xfj

WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lomu WPCOM Member wpcom-member allows Reflected XSS.This issue affects WPCOM Member: from n/a through <= 1.5.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00327 Published 2024-10-05 No fix listed CWE-79

TI-2024-06943 CVE-2024-7493 · GHSA-qcf5-7mv4-v635

WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

MEDIUM 50

The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00565 Published 2024-09-06 No fix listed CWE-269

Vulnerabilities

Filters

WPCOM Member <= 1.7.6 - Unauthenticated Time-Based SQL Injection

WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta