CVE-2024-11376: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11376?
CVE-2024-11376 is classified as a medium severity vulnerability due to its ability to exploit reflected cross-site scripting.
How do I fix CVE-2024-11376?
To fix CVE-2024-11376, update the s2Member plugin to version 241217 or later, which includes the necessary patches.
What type of attack does CVE-2024-11376 enable?
CVE-2024-11376 enables reflected cross-site scripting attacks that can compromise user sessions and inject malicious scripts.
Which versions of s2Member are affected by CVE-2024-11376?
CVE-2024-11376 affects all versions of the s2Member plugin up to and including 241216.
What is s2Member in the context of CVE-2024-11376?
s2Member is a WordPress plugin designed for memberships, content restriction, and member access subscriptions, which is affected by the vulnerability noted in CVE-2024-11376.