XSS in Imember360
CVE-2014-3842
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.045 (90.5th percentile) — read the EPSS interpretation.
Affected products
- Imember360 — versions 3.8.012, 3.8.013, 3.8.014
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
Frequently asked questions
- What is CVE-2014-3842?
- CVE-2014-3842 is a vulnerability in Imember360, classified under Cross-site Scripting. Published 2014-05-22.
- Is CVE-2014-3842 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.