CVE-2024-5081: WP eMember <= v10.7.0 - Stored XSS via CSRF
Published Aug 5, 2024
·Updated
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Affected Software
2 affected components
WP eMember<=10.7.0
Tipsandtricks-hq Wp Emember Wordpress<10.7.0
Event History
Aug 5, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-5081?
CVE-2024-5081 is considered a high severity vulnerability due to its potential to allow stored XSS attacks via CSRF.
2
How do I fix CVE-2024-5081?
To fix CVE-2024-5081, update the WP eMember plugin to version 10.7.0 or later.
3
What types of attacks can be conducted using CVE-2024-5081?
CVE-2024-5081 can be exploited to carry out stored XSS attacks against logged-in administrators.
4
Who is affected by CVE-2024-5081?
Users of the WP eMember WordPress plugin prior to version 10.7.0 are affected by CVE-2024-5081.
5
Does CVE-2024-5081 require user interaction for exploitation?
CVE-2024-5081 does not require user interaction for exploitation, making it a critical risk for web applications.