VulnerabilityModified
CVE-2014-3842
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.
MEDIUM 4.3EPSS 4.51%
Does this matter?
Lower severity and a low EPSS score (4.51%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 4.51% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- imember360/imember360
- Source
- cve@mitre.org
References
- http://osvdb.org/show/osvdb/106299
- http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html
- http://seclists.org/fulldisclosure/2014/Apr/265
- http://secunia.com/advisories/58094
- http://www.exploit-db.com/exploits/33076Exploit
- http://osvdb.org/show/osvdb/106299
- http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html
- http://seclists.org/fulldisclosure/2014/Apr/265
- http://secunia.com/advisories/58094
- http://www.exploit-db.com/exploits/33076Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.