CVE-2024-1985 — Cross-site Scripting in Simple Membership

CWE-79 — Cross-site ScriptingCWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
6.1MEDIUMNVD
CNA4.7
EPSS
3.3%
top 12.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Simple-membership-plugin Simple MembershipWpinsider-1 Simple Membership
Timeline
PublishedMar 13
Latest updateApr 12

Description

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

3
VulDB
Simple Membership Plugin up to 4.4.2 on WordPress cross site scripting↗2026-04-12
▶
GHSA
GHSA-qj8h-3x8j-cqw9: The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and in↗2024-03-13
▶
CVEList
Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting↗2024-03-13
▶
CVE-2024-1985 — Cross-site Scripting | cvebase