CVE-2024-1412: Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error
The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and including, 1.11.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note - the issue was partially patched in 1.11.25, but could still potentially be exploited under some circumstances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1412?
CVE-2024-1412 is considered a medium severity vulnerability due to the potential for unauthenticated attackers to exploit it.
How do I fix CVE-2024-1412?
To fix CVE-2024-1412, upgrade the Memberpress plugin to version 1.11.27 or later.
What versions of Memberpress are affected by CVE-2024-1412?
CVE-2024-1412 affects all versions of Memberpress up to and including 1.11.26.
What type of vulnerability is CVE-2024-1412?
CVE-2024-1412 is a Reflected Cross-Site Scripting vulnerability due to insufficient input sanitization.
Who can exploit CVE-2024-1412?
Unauthenticated attackers can exploit CVE-2024-1412 due to the lack of required authentication for the vulnerable parameters.