armemberplugin armember vulnerabilities

Latest armemberplugin armember CVEs

Newest publication first

1. CVE-2023-47837 WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerability

   Published 2024-06-04

   High·CVSS 8.8

   Improper Privilege Management vulnerability in Repute Infosystems ARMember allows Privilege Escalation.This issue affects ARMember: from n/a through 4.0.10.

2. CVE-2024-32948 WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability

   Published 2024-04-24

   Critical·CVSS 9.1

   Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.

3. CVE-2023-3996 ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

   Published 2023-10-20

   Medium·CVSS 4.8

   The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admini...

4. CVE-2022-47421 WordPress ARMember (free) and ARMember (premium) plugins - vulnerable to Auth. Stored Cross Site Scripting (XSS)

   Published 2023-07-18

   Medium·CVSS 4.8

   Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.

5. CVE-2023-3011 ARMember <= 4.0.5 - Cross-Site Request Forgery

   Published 2023-07-12

   High·CVSS 8.8

   The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple...

6. CVE-2022-42888 WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation

   Published 2022-12-06

   High·CVSS 8.8

   Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.

7. CVE-2022-1903 ARMember < 3.4.8 - Unauthenticated Admin Account Takeover

   Published 2022-06-27

   High·CVSS 8.1

   The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their usern...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.