---
id: "CVE-2026-93427"
page: "https://infrastack.ai/live/CVE-2026-93427"
kind: "vulnerability"
aliases: ["CVE-2026-93427"]
title: "ARMember WordPress plugin: stored XSS via registration custom field"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "armember", "fixed": ["7.8.2"], "affected": "<= 7.8.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["armember", "package", "self-hosted", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-10T07:16:53+00:00"
first_seen_at: "2026-11-10T07:20:33+00:00"
updated_at: "2026-11-10T07:22:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93427", "first_seen_at": "2026-11-10T07:20:33+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field", "first_seen_at": "2026-11-10T07:22:37+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field", "https://www.armemberplugin.com/changelog/"]}]
exploit_sources: []
---

# ARMember WordPress plugin: stored XSS via registration custom field

Link for people: https://infrastack.ai/live/CVE-2026-93427 (this .md is for agents)

The ARMember membership plugin for WordPress does not sanitize or escape the Registration Custom Field (Profile Cover) input, so an unauthenticated attacker can store script in it. The script runs in the browser of any user who opens the page where the injected value is shown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:armember affected <= 7.8.1 fixed 7.8.2

## How to check

- In WordPress admin go to Plugins > Installed Plugins and read the ARMember Premium version; 7.8.1 and earlier are affected, 7.8.2 and later are patched.
- Also check whether any registration form has the Profile Cover custom field (avatar/cover upload); the sources do not say if it is on by default.

## Fix

Update ARMember Premium to 7.8.2 or later (Wordfence lists 7.8.2 as the patched version; the latest release on the vendor changelog is 8.1.1).

## Timeline

- 2026-11-10T07:20:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93427
- 2026-11-10T07:22:37+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field — Wordfence advisory (CNA, researcher Rafie Muhammad) gives affected <= 7.8.1, patched 7.8.2. Vendor changelog for 7.8.2 (22 Sep 2026) says only 'Fixed a security issue related to the Avatar field', does not name the CVE or Profile Cover, so fix not marked verified. Default state of the Profile Cover field unknown. No exploitation or PoC found; did not search X.

## Documents

- [advisory] Wordfence: ARMember Premium <= 7.8.1 Unauthenticated Stored XSS via Registration Custom Field https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/armember/armember-premium-781-unauthenticated-stored-cross-site-scripting-via-registration-custom-field
- [fix] ARMember changelog (7.8.2: security issue related to the Avatar field) https://www.armemberplugin.com/changelog/

## From the sources

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_