ARMEMBER · CVE-2026-93427 · Package
FIX → 7.8.2
The ARMember membership plugin for WordPress does not sanitize or escape the Registration Custom Field (Profile Cover) input, so an unauthenticated attacker can store script in it. The script runs in the browser of any user who opens the page where the injected value is shown.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the ARMember Premium plugin version 7.8.1 or earlier on WordPress, where the registration form uses the Profile Cover custom field. The sources do not say whether the field is enabled by default. Sites without ARMember installed are not affected.
Not affected if newer-version, plugin-not-installed
Who cares armember, self-hosted, wordpress
Upgrade to 7.8.2
Update ARMember Premium to 7.8.2 or later (Wordfence lists 7.8.2 as the patched version; the latest release on the vendor changelog is 8.1.1).
The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.