meh1936

Just saw your most recent reply to the patch topic, that seems to indicate this is known.

In 3.5.0, go to includes/class-wp-members-pwd-reset.php and at line 213, change?esc_url?to?esc_url_raw?and retest. Then let me know the outcome.

I can confirm that this change works on my install.

“Rest assured that we are actively working through the process of getting the plugin back on www.remarpro.com and the plugin will be restored soon.”

From the plugin page now: This plugin has been closed as of March 7, 2024 and is not available for download. Reason: Security Issue.

Could you provide an update on this? What is soon? The plugin has been closed for two months now.

This was fixed in the development version, it seems. So hopefully it is coming soon in a future update. If you’d like to temporarily apply the fix on your site, here’s the relevant commit that should help you out.

https://github.com/rocketgeek/wp-members-dev/commit/f1af754e73138e41ca1c920d006d08ab2ca0f883