Ultimate Member

51 results · Feed

• High 7.2
  CVE-2022-3384

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options

  The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to n…

  Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  Nov 29, 2022
• Medium 4.3
  CVE-2022-3361

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes

  The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative …

  Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  Nov 29, 2022
• Medium 6.4
  CVE-2022-1208

  Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting

  The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web script…

  Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  Jun 13, 2022
• Medium 4.3
  CVE-2022-1209

  Ultimate Member <= 2.3.1 - Arbitrary Redirect

  The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, a…

  Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  May 10, 2022
• Unscored —
  CVE-2021-24306

  Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)

  The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated refle…

  Ultimate Member Ultimate Member – User Profile, User Registration, Login & Membership Plugin Web / CMS
  May 24, 2021
• Unscored —
  CVE-2018-0589

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access rest…

  Ultimate Member Ultimate Member
  May 14, 2018
• Unscored —
  CVE-2018-0590

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access rest…

  Ultimate Member Ultimate Member
  May 14, 2018
• Unscored —
  CVE-2018-0588

  Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress a…

  Ultimate Member Ultimate Member
  May 14, 2018
• Unscored —
  CVE-2018-0587

  Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote aut…

  Ultimate Member Ultimate Member
  May 14, 2018
• Unscored —
  CVE-2018-0585

  Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacke…

  Ultimate Member Ultimate Member
  May 14, 2018
• Unscored —
  CVE-2018-0586

  Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordP…

  Ultimate Member Ultimate Member
  May 14, 2018