CVE-2025-9489mediumCWE-94

CVE-2025-9489: falha de média gravidade em cbutlerjr WP-Members Membership Plugin

WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WP-Members Membership Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5epss 0.3%
The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
cbutlerjr · WP-Members Membership Plugin
CVEs relacionadas — cbutlerjr WP-Members Membership Plugin

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1852HIGHWP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.7%CVE-2023-2869MEDIUMWP-Members Membership <= 3.4.7.3 - Missing Authorization to Settings UpdateEPSS 0.5%CVE-2024-2920MEDIUMWP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive FilesEPSS 0.5%CVE-2024-9231MEDIUMWP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-10374MEDIUMWP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout ShortcodeEPSS 0.4%CVE-2023-6733MEDIUMWP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%