CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22308 – WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection
https://notcve.org/view.php?id=CVE-2024-22308
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1. Vulnerabilidad de redirección de URL a un sitio que no es de confianza ("Open Redirect") en smp7, wp.Insider Simple Membership. Este problema afecta a Simple Membership: desde n/a hasta 4.4.1. The Simple Membership plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 4.4.1. This is due to insufficient validation on the redirect url supplied via the swpm_page_url parameter. • https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-4-1-open-redirection-vulnerability?_s_id=cve • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50376 – WordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50376
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allows Reflected XSS.This issue affects Simple Membership: from n/a through 4.3.8. Neutralización incorrecta de la entrada durante la vulnerabilidad de generación de páginas web ('Cross site scripting') en smp7, wp.Insider Simple Membership permite XSS reflejado. Este problema afecta a Simple Membership: desde n/a hasta 4.3.8. The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in all versions up to 4.3.9 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-3-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-6882 – Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode
https://notcve.org/view.php?id=CVE-2023-6882
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘environment_mode’ parameter in all versions up to, and including, 4.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. El complemento Simple Membership para WordPress es vulnerable a Cross-Site Scripting reflejado a través del parámetro 'environment_mode' en todas las versiones hasta la 4.3.8 incluida debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en páginas que se ejecutan si logran engañar a un usuario para que realice una acción como hacer clic en un enlace. • https://plugins.trac.wordpress.org/changeset/3010737/simple-membership https://www.wordfence.com/threat-intel/vulnerabilities/id/366165fe-93e5-49ab-b2e5-1de624f22286?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4719 – Simple Membership <= 4.3.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2023-4719
The Simple Membership plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `list_type` parameter in versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. Using this vulnerability, unauthenticated attackers could inject arbitrary web scripts into pages that are being executed if they can successfully trick a user into taking an action, such as clicking a malicious link. El plugin Simple Membership para WordPress es vulnerable a Cross-Site Scripting (XSS) reflejado a través del parámetro "list_type" en versiones hasta, e incluyendo, la 4.3.5 debido a una insuficiente sanitización de entrada y escape de salida. Utilizando esta vulnerabilidad, los atacantes no autenticados podrían inyectar scripts web arbitrarios en las páginas que se están ejecutando si pueden engañar con éxito a un usuario para que realice una acción, como hacer clic en un enlace malicioso. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2962730%40simple-membership&new=2962730%40simple-membership&sfp_email=&sfph_mail= https://wordpress.org/plugins/simple-membership https://www.wordfence.com/threat-intel/vulnerabilities/id/e4b10172-7e54-4ff8-9fbb-41d160ce49e4?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0254 – Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injection
https://notcve.org/view.php?id=CVE-2023-0254
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. El complemento Simple Membership WP user Import para WordPress es vulnerable a la inyección SQL a través del parámetro 'orderby' en versiones hasta la 1.7 incluida debido a un escape insuficiente en el parámetro proporcionado por el usuario. Esto hace posible que atacantes autenticados con privilegios administrativos agreguen consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer información confidencial de la base de datos. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2829005%40simple-membership-wp-user-import&new=2829005%40simple-membership-wp-user-import&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/6f781533-b633-4452-95bd-c32ed0de2ea9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •