CVE-2014-3842

iMember360 3.8.012-3.9.001 - Cross-Site Scripting via Decrypt or Encrypt Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3842. PoCs published by Everett Griffiths.

AI-analyzed exploit summary The writeup details multiple vulnerabilities in the iMember360 WordPress plugin, including database credential disclosure, XSS, arbitrary user deletion, and arbitrary code execution via unescaped shell commands. It provides proof-of-concept parameters for exploitation but lacks executable code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.

Exploits (1)

exploitdb WRITEUP

by Everett Griffiths · textwebappsphp

https://www.exploit-db.com/exploits/33076

View Code ZIP pw:eip

The writeup details multiple vulnerabilities in the iMember360 WordPress plugin, including database credential disclosure, XSS, arbitrary user deletion, and arbitrary code execution via unescaped shell commands. It provides proof-of-concept parameters for exploitation but lacks executable code.

Classification

Writeup 90%

Attack Type

Info Leak | Xss | Auth Bypass | Rce

Complexity

Trivial

Reliability

Reliable

Target: iMember360 WordPress plugin v3.8.012 thru v3.9.001

Auth required

Prerequisites: Plugin installed · Admin access for RCE · No API key configured for user deletion

MITRE ATT&CK

T1005 - Data from Local System T1059 - Command and Scripting Interpreter T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58094

Exploit, Third Party Advisory x_refsource_misc

http://packetstormsecurity.com/files/126324/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html

Exploit exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/33076

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/show/osvdb/106299

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Apr/265

Scores

EPSS 0.0453

EPSS Percentile 90.3%

Details

CWE

CWE-79

Status published

Products (5)

imember360/imember360 3.8.012

imember360/imember360 3.8.013

imember360/imember360 3.8.014

imember360/imember360 3.9.000

imember360/imember360 3.9.001

Published May 22, 2014

Tracked Since Feb 18, 2026