Description
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wp-eMember | < 10.3.9 | 10.3.9 |
References
- https://wpscan.com/vulnerability/6cc05a33-6592-4d35-8e66-9b6a9884df7e/ exploit vdb-entry technical-description