CVE-2026-93427

{
  "etk_id": "ETK-2026-4043",
  "cve_id": "CVE-2026-93427",
  "display_id": "CVE-2026-93427",
  "ghsa_id": "GHSA-rr28-rm36-gvjf",
  "euvd_id": "EUVD-2026-120826",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in ARMember Premium for WordPress",
  "summary": "ARMember Premium for WordPress through version 7.8.1 mishandles input associated with the Profile Cover registration custom field. An unauthenticated attacker may cause browser-executed script to be stored and later run when another user views affected content.",
  "mitigation": "Update to a release later than 7.8.1 if one is available from the vendor. Until then, disable or restrict public access to registration and the Profile Cover custom field, and review existing submitted profile content.",
  "vendor": "armember",
  "product": "ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 7.8.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0105083,
  "t0_at": "2026-11-10T06:47:02.854000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-10T09:48:45.307741+00:00",
      "days": 0.1261858071875,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T06:47:02.854000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-10T06:47:02.854000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T06:47:02.854000+00:00",
      "url": "https://github.com/advisories/GHSA-rr28-rm36-gvjf"
    }
  }
}