CVE-2022-1724

Description

The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting

Affected products

• Unknown / Simple Membership4.1.1 – 4.1.1

Exploits & proofs of concept

• nucleiWordPress Simple Membership <4.1.1 - Cross-Site Scriptingby Akincibor

References

• MISChttps://wpscan.com/vulnerability/96a0a667-9c4b-4ea6-b78a-0681e9a9bbae