blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-4039

MEDIUM 5.4 CVSS 3.1
Published
January 6, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via unspecified (1) profile fields or (2) new post content. NOTE: CVE-2015-4038 can be used to bypass the administrator confirmation step for vector 2.

Affected products and versions

  • n/a n/a — Versions not specified
  • e-plugins wp_membership — Version 1.2.3

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/132011/WordPress-WP-Membership-1.2.3-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
  • www.securityfocus.com http://www.securityfocus.com/archive/1/archive/1/535586/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
  • www.securityfocus.com http://www.securityfocus.com/bid/74766 Third Party Advisory, VDB Entry
  • www.exploit-db.com https://www.exploit-db.com/exploits/37074/ Exploit, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record