Memberspace Vulnerabilities

[en] The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.

Affected:

up to 2.1.14

Fixed in:

2.1.14

Disclosed:

May 15, 2025

CVE-2024-13727 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MemberSpace allows Reflected XSS.This issue affects MemberSpace: from n/a through 2.1.13.

Affected:

up to 2.1.14

Fixed in:

2.1.14

Disclosed:

Mar 27, 2025

CVE-2025-26874 on NVD →

The MemberSpace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tr...

CVSS:

6.1

Affected:

up to 2.1.13

Fixed in:

2.1.14

Disclosed:

Mar 20, 2025

CVE-2025-26874 on NVD →

The MemberSpace – Membership Plugin and Paid Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVSS:

6.1

Affected:

up to 2.1.13

Fixed in:

2.1.14

Disclosed:

Mar 2, 2025

CVE-2024-13727 on NVD →