CriticalCVSS 9.3
EPSS 0.31%
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Vendor
reputeinfosystems vulnerabilities
74 published CVES affecting reputeinfosystems, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 74
- Critical
- 14
- High
- 27
- Medium
- 33
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- ARMember 15
- ARForms 14
- bookingpress 14
- ARForms Form Builder 9
- ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup 8
- Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress 7
- ARPrice 6
- Contact Form, Survey, Quiz & Popup Form Builder – ARForms 4
- Social Share And Social Locker 3
- appointment booking calendar plugin and scheduling plugin bookingpress 1
- ARMember Premium 1
- arprice lite 1
- contact form survey popup form plugin for wordpress - arforms form builder 1
- pricing table 1
- repute arforms 1
Latest reputeinfosystems CVEs
Newest publication first · page 1 of 3
-
-
CVE-2026-39766 WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
PublishedHighCVSS 7.1 EPSS 0.23%Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
-
CriticalCVSS 9.8 EPSS 0.76%
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers...
-
MediumCVSS 5.3 EPSS 0.72%
The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the...
-
HighCVSS 7.5 EPSS 0.34%
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user...
-
MediumCVSS 5.6 EPSS 0.29%
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a val...
-
HighCVSS 8.8 EPSS 0.31%
Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.
-
MediumCVSS 4.8 EPSS 0.33%
The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exam...
-
MediumCVSS 5.4 EPSS 0.34%
The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
-
CriticalCVSS 9.3 EPSS 0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Blind SQL Injection.This issue affects Social Share And Social Locker: from n/a th...
-
HighCVSS 7.1 EPSS 0.24%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Reflected XSS.This issue affects Social Share And Social Locker: from n/a through...
-
HighCVSS 7.6 EPSS 0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows SQL Injection.This issue affects BookingPress: from n/a through <= 1.1.28.
-
CVE-2025-26731 WordPress ARPrice plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability
PublishedMediumCVSS 6.5 EPSS 0.22%Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
-
CVE-2025-24732 WordPress BookingPress Plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerability
PublishedMediumCVSS 5.4 EPSS 0.32%Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.
-
HighCVSS 7.1 EPSS 0.32%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.
-
CriticalCVSS 9.8 EPSS 0.47%
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
-
HighCVSS 8.8 EPSS 0.81%
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
-
HighCVSS 8.5 EPSS 0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
-
CVE-2024-49655 WordPress ARPrice plugin <= 4.1.3 - Unauthenticated SQL Injection vulnerability
PublishedCriticalCVSS 9.3 EPSS 0.37%Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
-
MediumCVSS 4.3 EPSS 0.35%
Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.
-
MediumCVSS 6.5 EPSS 0.50%
The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpress_form' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the user...
-
CVE-2024-54217 WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability
PublishedMediumCVSS 5.4 EPSS 0.45%Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.
-
MediumCVSS 6.1 EPSS 0.33%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.
-
HighCVSS 7.7 EPSS 0.55%
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.
-
MediumCVSS 6.3 EPSS 0.37%
The The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.0.51. This is due to the software allowing users to execute an action t...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.