WP eMember < 10.3.9 - Reflected XSS

Vulnerability

The wp-eMember WordPress plugin versions prior to 10.3.9 do not properly sanitize and escape the fieldId parameter before outputting it back in the page. This lack of input validation and output escaping leads to a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] [1]. The affected plugin is wp-eMember, and the flaw exists in the handling of the fieldId parameter in certain pages.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a payload in the fieldId parameter. The attacker does not require authentication and can lure a victim into clicking the specially crafted link. When the victim, who has a valid session or is browsing the site, clicks the link, the injected script executes in their browser context [1]. No special network position or user interaction beyond clicking the link is needed.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can lead to information disclosure (e.g., stealing session cookies, tokens, or other sensitive data), defacement, or redirection to malicious sites. The CVSS score is 7.1 (High) [1], indicating significant potential impact on confidentiality, integrity, and availability of the affected WordPress instance, though the scope remains with the user's session.

Mitigation

The vulnerability is fixed in version 10.3.9 of the wp-eMember plugin [1]. Users should update to the latest patched version immediately. No workarounds are documented in the available references. The vulnerability is verified and publicly disclosed [1].