CVE-2024-7703

Summary

CVE-2024-7703 is a stored Cross-Site Scripting (XSS) vulnerability affecting the ARMember plugin, versions up to 4.0.37, used for membership management in WordPress. This issue allows authenticated attackers with Subscriber-level access and above to inject malicious scripts into SVG files. The insufficient input sanitization and output escaping in the plugin enable the execution of these scripts whenever a user accesses the affected SVG file. Successful exploitation could result in unintended actions, such as account takeover, data breaches, or even complete site compromise. It is recommended that users update the ARMember plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.