218 matches found
CVE-2019-14946
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations...
CVE-2018-20965
CVE-2018-20965 affects the WordPress plugin Ultimate Member (versions prior to 2.0.4). The connected documents confirm a Cross-Site Scripting (XSS) vulnerability in that plugin, caused by inadequate validation of client-side data. Impact stated across sources is XSS with no explicit exploitation ...
CVE-2016-10872
CVE-2016-10872 pertains to the WordPress plugin Ultimate Member (prior to version 1.3.40). The vulnerability is a cross-site scripting (XSS) flaw found on the login form, arising in the affected plugin’s handling of user-supplied data. Connected sources consistently describe the same issue and in...
CVE-2015-9304
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input...
CVE-2019-10271
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...
CVE-2019-10270
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...
Design/Logic Flaw
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...
CVE-2019-10270
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...
CVE-2019-10270
Affected software: WordPress Ultimate Member plugin. Vulnerable component: password reset flow in Ultimate Member (versions around 2.39; OpenVAS references
CVE-2019-10673
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...
CVE-2019-10673
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...
Cross site request forgery (csrf)
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...
CVE-2019-10673
CVE-2019-10673 affects the WordPress plugin “Ultimate Member” (versions before 2.0.40). A CSRF flaw in the logged-in user profile edit form lets an attacker elevate privileges by changing the admin email, then reset the admin password via WordPress password‑reset, enabling sensitive data access a...
CVE-2019-10673
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...
CVE-2018-17866
Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...
Design/Logic Flaw
The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...
CVE-2018-0589
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors...
CVE-2018-0586
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...