Reputeinfosystems vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Reputeinfosystems products: 9 record(s), with severity, exploitation and fixes.

ARForms 2 BookingPress Appointment Booking Pro 2 ARMember Premium 2 Armember 1 ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup 1 Contact Form, Survey, Quiz & Popup Form Builder – ARForms 1

Exploited only (KEV) →

CVE-2026-42417 Critical · 9.3 CWE-89 Oct 6, 2026

WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

CVE-2026-39766 High · 7.1 CWE-79 Oct 6, 2026

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

CVE-2026-27060 High · 8.8 CWE-502 Jul 2, 2026

WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6.

CVE-2026-11823 High · 7.5 CWE-89 Jul 1, 2026

BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter

The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-57338 High · 7.1 CWE-79 Jun 29, 2026

WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

CVE-2026-6960 Critical · 9.8 CWE-434 May 21, 2026

BookingPress Pro for WordPress: Unrestricted File Upload (CVE-2026-6960)

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.

CVE-2026-7649 High · 7.5 CWE-89 May 2, 2026

ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2024-13785 Medium · 5.6 CWE-94 Mar 21, 2026

Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution

The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

CVE-2022-47425 High · 8.8 CWE-862 Dec 9, 2025

WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control

Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.