Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 59

Export CSV
CVE-2024-13784

Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems Wordpress
Products
Contact Form, Survey, Quiz & Popup Form Builder – Arforms Wordpress
CVE-2026-15302

ARMember <= 4.0.27 - Directory Traversal via X-FILENAME

The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This makes it possible for unauthenticated attackers to upload and overwrite certain files (e.g., CSS) to directories outside the 'wp-content/uploads/armember' directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems Wordpress
Products
Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup Wordpress
CVE-2024-54216

WordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Arforms
CVE-2026-7649

ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems Wordpress
Products
Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup Wordpress
CVE-2024-32948

WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Armemberplugin Reputeinfosystems
Products
Armember Armember
CVE-2024-31296

WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.81.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Bookingpress
CVE-2023-39994

WordPress ARMember Premium plugin <= 5.9.2 - Broken Access Control

Missing Authorization vulnerability in Repute InfoSystems ARMember Premium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember Premium: from n/a through 5.9.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2022-46808

WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2024-32706

WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Arforms
CVE-2024-32702

WordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Arforms
CVE-2024-31272

WordPress ARForms Form Builder plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Arforms Form Builder
CVE-2024-31270

WordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Arforms Form Builder
CVE-2024-30223

WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2024-30222

WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2024-27995

WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: from n/a through 4.0.23.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2023-52200

WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection

Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup.This issue affects ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: n/a.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Armember
CVE-2023-51405

WordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability

Improper Authentication vulnerability in Repute Infosystems BookingPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BookingPress: from n/a through 1.0.74.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Reputeinfosystems
Products
Bookingpress