CVE-2024-9222

Summary

CVE-2024-9222: Unauthenticated attackers can exploit the Reflected Cross-Site Scripting vulnerability in the Paid Membership Subscriptions plugin for WordPress, affecting versions up to 2.12.8. This issue arises due to the improper use of add_query_arg without sufficient escaping in plugin URLs. Successful exploitation allows attackers to inject arbitrary web scripts into pages, which can be executed by tricking users into taking specific actions like clicking on malicious links.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.