Cross-site scripting in Paid Memberships Pro - CVE-2015-5532

Description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the Paid Memberships Pro (PMPro) plugin before 1.8.4.3 for WordPress when processing the (1) s parameter to membershiplevels.php, (2) memberslist.php, or (3) orders.php in adminpages/ or the (4) edit parameter to adminpages/membershiplevels.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

External links

• http://packetstormsecurity.com/files/132812/WordPress-Paid-Memberships-Pro-1.8.4.2-Cross-Site-Scripting.html
• http://www.paidmembershipspro.com/2015/07/pmpro-updates-1-8-4-3-and-1-8-4-4/
• http://www.securityfocus.com/archive/1/536057/100/0/threaded
• https://github.com/strangerstudios/paid-memberships-pro/commit/add03e3ed90e9163e5a46e20e6c371a87ff5a677
• https://wordpress.org/plugins/paid-memberships-pro/#developers
• https://wpvulndb.com/vulnerabilities/8109
• https://www.htbridge.com/advisory/HTB23264