CVE-2015-5532 — Cross-site Scripting in Paid Memberships PRO

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
1.3%
top 20.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Strangerstudios Paid Memberships PRO
Timeline
PublishedOct 23
Latest updateMay 13

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x2rg-xxr8-r35f: Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1↗2022-05-13
▶
CVEList
CVE-2015-5532: Multiple cross-site scripting (XSS) vulnerabilities in the Paid Memberships Pro (PMPro) plugin before 1↗2017-10-23
▶
CVE-2015-5532 — Cross-site Scripting | cvebase