CVE-2024-5744

The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2024-07-13

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ba50e25c-7250-4025-a72f-74f8eb756246/

References

• CVE Record
• NVD entry

Related

• CVE-2024-57430
• CVE-2024-5745
• CVE-2024-57429
• CVE-2024-57450
• CVE-2024-57428
• CVE-2024-57451