CVE-2024-5074: 
WordPress vulnerability analysis and mitigation

The wp-eMember WordPress plugin before version 10.6.6 contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-5074). The vulnerability was discovered on June 22, 2024, and affects the plugin's parameter handling functionality. This security issue specifically impacts high-privilege users such as administrators (WPScan).

The vulnerability stems from improper sanitization and escaping of parameters before they are output back to the page. The CVSS score assigned by CISA-ADP is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-79 (Cross-Site Scripting) and is categorized as A7 in the OWASP Top 10 (WPScan, NVD).

The vulnerability allows for Reflected Cross-Site Scripting attacks specifically targeting high-privilege users such as administrators. This could potentially lead to unauthorized actions being performed in the context of the administrator's session (WPScan).

The vulnerability has been fixed in version 10.6.6 of the wp-eMember plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).