In the plugin installed on over 60,000 web sites (WP-Members Membership – a membership plugin with content restriction and custom registration) an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability has been reported recently. It is recommended that you update your sites immediately. In order to avoid web site crashes and to assure timely security updates it is best to use our WordPress Maintenance Service.
WP-Members Membership Plugin <= 3.4.9.2 – Unauthenticated Stored Cross-Site Scripting vulnerability
Plugin slug: wp-members
Update to version: 3.4.9.3
The vulnerability allows hackers to inject arbitrary JavaScript via the X-Forwarded-For header, used by the plugin for logging purposes. When viewed by the administrator, the malicious code would be executed in the context of the administrator’s browser session and would allow the creation of malicious administrator users as well as any changes to the affected site’s settings which could lead to a complete site takeover.