Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress, f5105e3a-75c8-4312-93da-cef04d665f2a

CVE, Research URL: f5105e3a-75c8-4312-93da-cef04d665f2a
Home page URL: Security reports for Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Application: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Published on: -
Research Description: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress [wp-user-avatar] < 3.1.11 ProfilePress < 3.1.11 - Multiple Vulnerabilities The plugin changelog stated multiple vulnerability fixes, including Cross-Site Scripting (XSS), SQL escaping and redirection validation. The changelog stated: - Fixed missing sql unescaping in member directory search. - Validate redirect_to urls to prevent redirect to another site. - XSS fix by escaping variables in tab widget.
Affected versions: max 3.1.11.
Status: vulnerable

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile &amp; Restrict Content – ProfilePress, f5105e3a-75c8-4312-93da-cef04d665f2a