Butlerblog
Butlerblog Wp-members: vulnerabilidades y CVE
Butlerblog Wp-members tiene 17 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE17
Últimos 12 meses3
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-2363 | Media (6.5) | 0.26% | — | 4 mar 2026 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the [wpmem_user_membership_posts] shortcode in all versions up to, and including, 3.5.5.1. This is due… |
| CVE-2025-14448 | Media (5.4) | 0.21% | — | 15 ene 2026 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions up to, and including, 3.5.4.3 due to… |
| CVE-2025-12648 | Media (5.3) | 0.30% | — | 7 ene 2026 | The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories… |
| CVE-2025-57973 | Media (5.5) | 0.19% | — | 22 sept 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4.2. |
| CVE-2025-9489 | Media (5) | 0.29% | — | 9 sept 2025 | The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action… |
| CVE-2025-7495 | Media (6.4) | 0.32% | — | 22 jul 2025 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all versions up to, and including, 3.5.4.1 due to insufficient input… |
| CVE-2025-50051 | Media (6.5) | 0.23% | — | 20 jun 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through <= 3.5.4. |
| CVE-2025-4610 | Media (6.4) | 0.38% | — | 17 may 2025 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_user_memberships shortcode in all versions up to, and including, 3.5.2 due to insufficient input… |
| CVE-2024-10374 | Media (5.4) | 0.45% | — | 25 oct 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode in all versions up to, and including, 3.4.9.5 due to insufficient input… |
| CVE-2024-9231 | Media (6.1) | 0.47% | — | 22 oct 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including,… |
| CVE-2024-2920 | Media (5.3) | 0.50% | — | 26 abr 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible… |
| CVE-2024-1852 | Media (6.1) | 0.68% | — | 9 abr 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.4.9.2 due to insufficient input sanitization and… |
| CVE-2024-1987 | Media (5.4) | 0.36% | — | 8 mar 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and… |
| CVE-2023-6733 | Media (6.5) | 0.44% | — | 4 ene 2024 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated… |
| CVE-2023-2869 | Media (4.3) | 0.50% | — | 12 jul 2023 | The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This… |
| CVE-2019-15660 | Alta (8.8) | 0.68% | — | 27 ago 2019 | The wp-members plugin before 3.2.8 for WordPress has CSRF. |
| CVE-2017-2222 | Media (6.1) | 1.8% | — | 7 jul 2017 | Cross-site scripting vulnerability in WP-Members prior to version 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |