CVE-2026-93427: ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field
The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can exploit the issue remotely without privileges or user interaction. The injected script executes when another user accesses a page containing the malicious registration custom-field content.
Which installations are affected?
ARMember Premium versions up to and including 7.8.1 are affected. The issue is in the Registration Custom Field used for the Profile Cover.
What is the potential impact?
Because the payload is stored and runs in a visitor's browser, an attacker can execute arbitrary web scripts in the context of affected pages. The reported impact includes low confidentiality and integrity impact, with no availability impact.