Vulnerabilities and security researches formemberlite-shortcodes memberlite-shortcodes

Jun 07, 2024

CVE, Research URL: CVE-2023-5237
Home page URL: Security reports for Memberlite Shortcodes
Application: Memberlite Shortcodes
Date: Oct 31, 2023
Research Description: The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Affected versions: max 1.3.9.
Status: vulnerable

CVE, Research URL: c35d1c7ca3f51b7af6a1ca01d23fd36f0cf6fff8
Home page URL: Security reports for Memberlite Shortcodes
Application: Memberlite Shortcodes
Date: Sep 21, 2023
Research Description: Memberlite Shortcodes [memberlite-shortcodes] < 1.3.9 Memberlite Shortcodes <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.3.9.
Status: vulnerable

Nov 25, 2024

CVE, Research URL: CVE-2024-11227
Home page URL: Security reports for Memberlite Shortcodes
Application: Memberlite Shortcodes
Date: Nov 23, 2024
Research Description: Memberlite Shortcodes [memberlite-shortcodes] <= 1.3.9 (unfixed) CVE-2024-11227 [en] The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's memberlite_accordion shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.3.9.
Status: vulnerable

Oct 11, 2025

CVE, Research URL: CVE-2025-10125
Home page URL: Security reports for Memberlite Shortcodes
Application: Memberlite Shortcodes
Date: Sep 17, 2025
Research Description: The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.4.1.
Status: vulnerable

Nov 10, 2025

CVE, Research URL: CVE-2025-48087
Home page URL: Security reports for Memberlite Shortcodes
Application: Memberlite Shortcodes
Date: Oct 17, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.
Affected versions: max 1.4.1.
Status: vulnerable