Memberlite Shortcodes Vulnerabilities

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 1.4.1

Fix:

No patched version reported

Disclosed:

Oct 17, 2025

CVE-2025-48087 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.

Affected:

up to 1.4.1

Fix:

No patched version reported

Disclosed:

Oct 17, 2025

CVE-2025-48087 on NVD →

[en] The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co...

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Sep 17, 2025

CVE-2025-10125 on NVD →

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib...

CVSS:

6.4

Affected:

up to 1.4

Fixed in:

1.4.1

Disclosed:

Sep 16, 2025

CVE-2025-10125 on NVD →

[en] The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated at...

Affected:

up to 1.4

Fixed in:

1.4

Disclosed:

Nov 23, 2024

CVE-2024-11227 on NVD →

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

CVSS:

6.4

Affected:

up to 1.3.9

Fixed in:

1.4

Disclosed:

Nov 22, 2024

CVE-2024-11227 on NVD →

[en] The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users su...

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Oct 31, 2023

CVE-2023-5237 on NVD →

Update the WordPress Memberlite Shortcodes plugin to the latest available version (at least 1.3.9). Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Memberlite Shortcodes Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements,...

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Sep 22, 2023

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-le...

CVSS:

6.4

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Sep 21, 2023

CVE-2023-5237 on NVD →

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-le...

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Sep 21, 2023