Vulnerabilidades de Reputeinfosystems
CVEs publicadas que afetam produtos de Reputeinfosystems: 7 registro(s), com severidade, exploração e correções.
ARForms 2Armember 1ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup 1BookingPress Appointment Booking Pro 1ARMember Premium 1Contact Form, Survey, Quiz & Popup Form Builder – ARForms 1
CVE-2026-42417
Crítica · 9.3
CWE-89 06/10/2026
WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
CVE-2026-39766
Alta · 7.1
CWE-79 06/10/2026
WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVE-2026-57338
Alta · 7.1
CWE-79 29/06/2026
WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.
CVE-2026-6960
Crítica · 9.8
CWE-434 21/05/2026
BookingPress Pro para WordPress: upload irrestrito de arquivos (CVE-2026-6960)
O plugin BookingPress Pro para WordPress é vulnerável a uploads arbitrários de arquivos devido à ausência de validação do tipo de arquivo na função 'bookingpress_validate_submitted_booking_form_func' em todas as versões até a 5.6 inclusive. Isso torna possível que atacantes não autenticados enviem arquivos arbitrários para o servidor do site afetado, o que pode viabilizar execução remota de código. Observação: a vulnerabilidade só pode ser explorada se um campo personalizado de assinatura for adicionado ao formulário de reserva.
CVE-2026-7649
Alta · 7.5
CWE-89 02/05/2026
ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.0.60 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2024-13785
Média · 5.6
CWE-94 21/03/2026
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2022-47425
Alta · 8.8
CWE-862 09/12/2025
WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control
Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.