Known XSS flaw in plugin left unfixed
Known cross-site scripting flaw in the plugin is reported repeatedly but never patched or answered by its developer.
5 public reports · first reported 29 March 2022 · last reported 24 August 2023
What's going wrong
The HM Multiple Roles plugin has a reflected cross-site scripting flaw that was reported in July 2023 and several times after, through the support forum, a security scanner, and a vulnerability database. Site owners say no fix or reply came from the developer, so some deactivated the plugin entirely. Injected scripts could redirect visitors or show advertisements on affected sites. Owners running several sites or agencies are the most exposed, since they need to know which sites are at risk. The gap is a service that watches installed plugins for known vulnerabilities, tells owners exactly which sites are affected, and offers an interim patch or replacement path until an official fix ships.
AI-assisted: written with the help of AI from the reports.
Products affected
HM Multiple Roles.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.