{"api_version":"1","generated_at":"2026-07-23T09:34:49+00:00","cve":"CVE-2014-3842","urls":{"html":"https://cve.report/CVE-2014-3842","api":"https://cve.report/api/cve/CVE-2014-3842.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3842","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3842"},"summary":{"title":"CVE-2014-3842","description":"Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-05-22 15:13:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2014/Apr/265","name":"http://seclists.org/fulldisclosure/2014/Apr/265","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Multiple Vulnerabilities in iMember360 (Wordpress plugin)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/show/osvdb/106299","name":"http://osvdb.org/show/osvdb/106299","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","name":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"WordPress iMember360is 3.9.001 XSS / Disclosure / Code Execution ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.exploit-db.com/exploits/33076","name":"http://www.exploit-db.com/exploits/33076","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Wordpress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/58094","name":"http://secunia.com/advisories/58094","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA58094 - WordPress iMember360 Plugin Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3842","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3842","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.012","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.013","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.8.014","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.9.000","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"3842","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"imember360","cpe5":"imember360","cpe6":"3.9.001","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:57:17.567Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"58094","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/58094"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/33076"},{"name":"106299","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/show/osvdb/106299"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2014/Apr/265"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-05-22T15:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"58094","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/58094"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/33076"},{"name":"106299","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/show/osvdb/106299"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2014/Apr/265"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-3842","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"58094","refsource":"SECUNIA","url":"http://secunia.com/advisories/58094"},{"name":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html"},{"name":"33076","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/33076"},{"name":"106299","refsource":"OSVDB","url":"http://osvdb.org/show/osvdb/106299"},{"name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2014/Apr/265"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-3842","datePublished":"2014-05-22T15:00:00.000Z","dateReserved":"2014-05-22T00:00:00.000Z","dateUpdated":"2024-09-17T00:06:47.466Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-05-22 15:13:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.012:*:*:*:*:wordpress:*:*","matchCriteriaId":"8350DF7B-F197-4A88-A71B-0266FB93C5AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.013:*:*:*:*:wordpress:*:*","matchCriteriaId":"C8D08029-AA96-404B-BA06-935502F55D4B"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.8.014:*:*:*:*:wordpress:*:*","matchCriteriaId":"71D63ADE-4550-4908-B7E5-6EA8FD837BA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.9.000:*:*:*:*:wordpress:*:*","matchCriteriaId":"2770E68B-B66C-44AD-802F-A89F83E8C33C"},{"vulnerable":true,"criteria":"cpe:2.3:a:imember360:imember360:3.9.001:*:*:*:*:wordpress:*:*","matchCriteriaId":"836D2850-2D63-4AE3-AE20-49B4DA9BA80D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3842","Ordinal":"1","Title":"CVE-2014-3842","CVE":"CVE-2014-3842","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3842","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.","Type":"Description","Title":"CVE-2014-3842"},{"CveYear":"2014","CveId":"3842","Ordinal":"2","NoteData":"2014-05-22","Type":"Other","Title":"Published"}]}}}