{"id":"CVE-2026-93427","kind":"vulnerability","aliases":["CVE-2026-93427"],"related":[],"title":"ARMember WordPress plugin: stored XSS via registration custom field","description":"The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The ARMember membership plugin for WordPress does not sanitize or escape the Registration Custom Field (Profile Cover) input, so an unauthenticated attacker can store script in it. The script runs in the browser of any user who opens the page where the injected value is shown.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"armember","fixed":["7.8.2"],"affected":"<= 7.8.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["armember","package","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- In WordPress admin go to Plugins > Installed Plugins and read the ARMember Premium version; 7.8.1 and earlier are affected, 7.8.2 and later are patched.\n- Also check whether any registration form has the Profile Cover custom field (avatar/cover upload); the sources do not say if it is on by default.","fix":"Update ARMember Premium to 7.8.2 or later (Wordfence lists 7.8.2 as the patched version; the latest release on the vendor changelog is 8.1.1).","status":"open","published_at":"2026-11-10T07:16:53+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","triaged_at":"2026-11-10T07:21:00+00:00","updated_at":"2026-11-10T07:22:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T07:21:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ARMember WordPress plugin: stored XSS via registration custom field","impact":"medium","summary":"The ARMember membership plugin for WordPress does not sanitize or escape the Registration Custom Field (Profile Cover) input, so an unauthenticated attacker can store script in it. The script runs in the browser of any user who opens the page where the injected value is shown.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","armember","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed version and default state of the Registration Custom Field (Profile Cover) setting from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93427.","how_to_check":"- Check the installed ARMember Premium plugin version in the WordPress admin under Plugins; affected versions are all up to and including `7.8.1`.\n- Look for the plugin's registration form settings that include a Profile Cover custom field.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the ARMember Premium plugin version 7.8.1 or earlier on WordPress, where the registration form uses the Profile Cover custom field. The sources do not say whether the field is enabled by default. Sites without ARMember installed are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000753,"input_tokens":4623,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and default state of the Registration Custom Field (Profile Cover) setting from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93427.","search":"'-2026':11A,14A '-93427':12A,15A '7.8.1':106C 'access':135C 'arbitrari':124C 'armemb':1A,17B,24B,70C 'armember':16A 'attack':44B,121C 'browser':55B 'content':74C 'cover':39B,98C 'cross':90C 'cross-sit':89C 'custom':8A,36B,95C 'cve':10A,13A 'due':107C 'escap':33B,114C 'execut':131C 'field':9A,37B,96C 'host':21B 'includ':105C 'inject':65B,123C,137C 'input':40B,110C 'insuffici':109C 'level':77C 'make':116C 'member':76C 'membership':25B,72C 'open':60B 'output':113C 'packag':18B 'page':62B,128C,138C 'plugin':3A,26B,73C,82C 'possibl':118C 'premium':71C 'profil':38B,79C,97C 'registr':7A,35B,94C 'restrict':75C 'run':52B 'sanit':31B,111C 'script':47B,51B,92C,126C 'self':20B 'self-host':19B 'shown':68B 'signup':81C 'site':91C 'store':4A,46B,88C 'unauthent':43B,120C 'user':58B,78C,80C,134C 'valu':66B 'version':101C 'via':6A,93C 'vulner':86C 'web':125C 'whenev':132C 'wordpress':2A,22B,28B,84C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running the ARMember Premium plugin version 7.8.1 or earlier on WordPress, where the registration form uses the Profile Cover custom field. The sources do not say whether the field is enabled by default. Sites without ARMember installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["armember"],"ptokens":["armember"],"labels":["armember","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-2026':11A,14A '-93427':12A,15A 'armemb':1A 'armember':16A 'custom':8A 'cve':10A,13A 'field':9A 'plugin':3A 'registr':7A 'store':4A 'via':6A 'wordpress':2A 'xss':5A","search_b":"'armemb':17B,24B 'attack':44B 'browser':55B 'cover':39B 'custom':36B 'escap':33B 'field':37B 'host':21B 'inject':65B 'input':40B 'membership':25B 'open':60B 'packag':18B 'page':62B 'plugin':26B 'profil':38B 'registr':35B 'run':52B 'sanit':31B 'script':47B,51B 'self':20B 'self-host':19B 'shown':68B 'store':46B 'unauthent':43B 'user':58B 'valu':66B 'wordpress':22B,28B","search_c":"'7.8.1':106C 'access':135C 'arbitrari':124C 'armemb':70C 'attack':121C 'content':74C 'cover':98C 'cross':90C 'cross-sit':89C 'custom':95C 'due':107C 'escap':114C 'execut':131C 'field':96C 'includ':105C 'inject':123C,137C 'input':110C 'insuffici':109C 'level':77C 'make':116C 'member':76C 'membership':72C 'output':113C 'page':128C,138C 'plugin':73C,82C 'possibl':118C 'premium':71C 'profil':79C,97C 'registr':94C 'restrict':75C 'sanit':111C 'script':92C,126C 'signup':81C 'site':91C 'store':88C 'unauthent':120C 'user':78C,80C,134C 'version':101C 'via':93C 'vulner':86C 'web':125C 'whenev':132C 'wordpress':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T07:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93427","severity":null,"published_at":"2026-11-10T07:16:53+00:00","modified_at":"2026-11-10T07:16:53+00:00","first_seen_at":"2026-11-10T07:20:33+00:00","fetched_at":"2026-11-10T07:20:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93427:2423","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field","severity":null,"published_at":"2026-11-10T07:22:37+00:00","modified_at":"2026-11-10T07:22:37+00:00","first_seen_at":"2026-11-10T07:22:37+00:00","fetched_at":"2026-11-10T07:22:37+00:00","note":"Wordfence advisory (CNA, researcher Rafie Muhammad) gives affected <= 7.8.1, patched 7.8.2. Vendor changelog for 7.8.2 (22 Sep 2026) says only 'Fixed a security issue related to the Avatar field', does not name the CVE or Profile Cover, so fix not marked verified. Default state of the Profile Cover field unknown. No exploitation or PoC found; did not search X.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field","https://www.armemberplugin.com/changelog/"]}],"documents":[{"id":113724,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field","title":"Wordfence: ARMember Premium <= 7.8.1 Unauthenticated Stored XSS via Registration Custom Field","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":113727,"url":"https://www.armemberplugin.com/changelog/","title":"ARMember changelog (7.8.2: security issue related to the Avatar field)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}