CVE-2018-17866

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

PT-2018-14233

Name of the Vulnerable Software and Affected Versions Ultimate Member - User Profile & Membership plugin versions prior to 2.0.28 Description The issue allows remote attackers to inject arbitrary web script or HTML via the Primary button Text or Second button text field, potentially leading to...