CVE-2022-47421: WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)
First published: Tue Jul 18 2023(Updated: )
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
Credit: audit@patchstack.com audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Repute Infosystems ARMember – Membership Plugin | <4.0.5 | |
| Repute Infosystems ARMember – Membership Plugin | <=5.8 |
Remedy
Update the ARMember (free) to 4.0.5 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-plugin-4-0-4-stored-cross-site-scripting-xss-on-common-messages-settings?_s_id=cve
- https://patchstack.com/database/vulnerability/armember/wordpress-armember-premium-wordpress-membership-plugin-plugin-5-8-stored-cross-site-scripting-xss?_s_id=cve
Frequently Asked Questions
What is the severity of CVE-2022-47421?
The severity of CVE-2022-47421 is medium (4.8).
What is the vulnerability in Repute InfoSystems ARMember plugin?
The vulnerability in Repute InfoSystems ARMember plugin is a stored Cross-Site Scripting (XSS) vulnerability.
Which versions of Repute InfoSystems ARMember plugin are affected?
Versions up to but excluding 4.0.5 of the free plugin, and versions up to and including 5.8 of the premium plugin are affected.
How can the stored Cross-Site Scripting (XSS) vulnerability be exploited?
The stored Cross-Site Scripting (XSS) vulnerability can be exploited by an authenticated administrator or higher user.
How can I fix the stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin?
To fix the stored Cross-Site Scripting (XSS) vulnerability, update the plugin to version 4.0.5 for the free plugin or version 5.8 for the premium plugin.
- collector/nvd-latest
- agent/references
- agent/author
- agent/type
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/armemberplugin
- canonical/repute infosystems armember – membership plugin
- version/repute infosystems armember – membership plugin/5.8