CVE-2011-5082 s2Member® Framework (Membership, Member Level Roles, Access Capabilities, PayPal Members) < 111220 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| s2member | <= 111216 | No fix listed |
| s2member | = 110604 | No fix listed |
| s2member | = 110605 | No fix listed |
| s2member | = 110606 | No fix listed |
| s2member | = 110617 | No fix listed |
| s2member | = 110620 | No fix listed |
| s2member | = 110708 | No fix listed |
| s2member | = 110709 | No fix listed |
| s2member | = 110710 | No fix listed |
| s2member | = 110731 | No fix listed |
| s2member | = 110812 | No fix listed |
| s2member | = 110815 | No fix listed |
| s2member | = 110912 | No fix listed |
| s2member | = 110913 | No fix listed |
| s2member | = 110915 | No fix listed |
| s2member | = 110926 | No fix listed |
| s2member | = 110927 | No fix listed |
| s2member | = 111002 | No fix listed |
| s2member | = 111003 | No fix listed |
| s2member | = 111011 | No fix listed |
| s2member | = 111017 | No fix listed |
| s2member | = 111029 | No fix listed |
| s2member | = 111105 | No fix listed |
| s2member | = 111206 | No fix listed |
| wordpress s2member(WordPress) | < 111220 | 111220 |
References
- 47954 third-party-advisory vendor-advisory
- www.primothemes.com
- 51997 vdb-entry
- s2memberpro-couponcode-xss(73202) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org