CveMateVulnerability intelligence

Reputeinfosystems vulnerabilities

74 vulnerabilities

Known vulnerabilities in Reputeinfosystems products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.

Products

14

Armember15 vulnerabilities
Bookingpress14 vulnerabilities
Arforms13 vulnerabilities
Armember – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup8 vulnerabilities
Appointment Booking Calendar Plugin And Scheduling Plugin – Bookingpress7 vulnerabilities
Arforms Form Builder6 vulnerabilities
Arprice6 vulnerabilities
Contact Form, Survey, Quiz & Popup Form Builder – Arforms4 vulnerabilities
Social Share And Social Locker3 vulnerabilities
Armember Premium1 vulnerabilities
Arprice Lite1 vulnerabilities
Contact Form\, Survey \& Popup Form Plugin For Wordpress Arforms Form Builder1 vulnerabilities
Pricing Table1 vulnerabilities
Repute Arforms1 vulnerabilities

CVE-2018-15818reputeinfosystemsrepute_arforms+17y ago17-03-2019 21:30

An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with web server privileges by sending a malicious request to admin-ajax.php.CVE-2021-24718reputeinfosystemscontact_form\,_survey_\&_popup_form_plugin_for_wordpress_-_arforms_form_builder+24y ago06-12-2021 15:55

The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed CVE-2025-26731reputeinfosystemsarprice+11y ago27-03-2025 14:01

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Stored XSS.This issue affects ARPrice: from n/a through <= 4.1.3.CVE-2025-31902reputeinfosystemssocial_share_and_social_locker+11y ago03-04-2025 13:27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Reflected XSS.This issue affects Social Share And Social Locker: from n/a through <= 1.4.1.CVE-2025-31910reputeinfosystemsbookingpress+11y ago01-04-2025 14:52

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows SQL Injection.This issue affects BookingPress: from n/a through <= 1.1.28.CVE-2025-31911reputeinfosystemssocial_share_and_social_locker+11y ago03-04-2025 13:27

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems Social Share And Social Locker social-share-and-social-locker-arsocial allows Blind SQL Injection.This issue affects Social Share And Social Locker: from n/a through <= 1.4.2.CVE-2025-24732reputeinfosystemsbookingpress+11y ago24-01-2025 17:25

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-booking allows DOM-Based XSS.This issue affects BookingPress: from n/a through <= 1.1.25.CVE-2022-47140repute infosystemsarmember+23y ago12-06-2023 12:52

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.CVE-2022-47425repute infosystemsarmember+210mo ago09-12-2025 16:41

Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.CVE-2022-47424repute infosystemsarmember+31y ago19-11-2024 17:21

Cross-Site Request Forgery (CSRF) vulnerability in Repute InfoSystems ARMember, Repute InfoSystems ARMember Premium allows Cross-Site Request Forgery.This issue affects ARMember: from n/a through 4.0.5; ARMember Premium: from n/a before 6.7.1.CVE-2022-42888armemberpluginarmember+23y ago06-12-2022 20:46

Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.CVE-2022-0739reputeinfosystemsbookingpress+24y ago21-03-2022 18:56

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection CVE-2022-0867reputeinfosystemspricing_table+24y ago16-05-2022 14:30

The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users CVE-2022-4340reputeinfosystemsbookingpress+23y ago02-01-2023 21:49

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.CVE-2022-46808repute infosystemsarmember+22y ago03-11-2023 12:36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.CVE-2022-45838repute infosystemsarforms form builder+23y ago18-04-2023 12:11

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions.CVE-2024-54216reputeinfosystemsarforms+11y ago06-12-2024 13:07

Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.CVE-2024-54223reputeinfosystemsarforms_form_builder+11y ago09-12-2024 11:31

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.CVE-2024-54217reputeinfosystemsarforms+11y ago09-12-2024 12:58

Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.CVE-2024-13784reputeinfosystemscontact form, survey, quiz & popup form builder – arforms+12mo ago16-08-2026 08:31

The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.