Wordpress WP-Members Plugin HTML Injection and Cross Site Scripting vulnerabilities

Bugtraq ID:	64713
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 07 2014 12:00AM
Updated:	Jan 07 2014 12:00AM
Credit:	Stefan Schurtz
Vulnerable:	WordPress WP-Members 2.8.9
Not Vulnerable:	WordPress WP-Members 2.8.10

Wordpress WP-Members Plugin HTML Injection and Cross Site Scripting vulnerabilities

WP-Members plugin is prone to HTML-injection and cross-site scripting vulnerabilities.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

WP-Members 2.8.9 is vulnerable; other versions may also be affected.

Wordpress WP-Members Plugin HTML Injection and Cross Site Scripting vulnerabilities

Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issues, an attacker must entice an unsuspecting user into following a malicious URI.

Wordpress WP-Members Plugin HTML Injection and Cross Site Scripting vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Wordpress WP-Members Plugin HTML Injection and Cross Site Scripting vulnerabilities

References:

• Wordpress Plugin WP-Members Version 2.8.9 - Stored and reflected Cross-site Scr (seclists)
  
• WP-Members Homepage (WordPress)