Cross site scripting

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354

CVE-2015-8354 affects the WordPress Ultimate Member plugin (versions prior to 1.3.29). The root cause is lack of input filtering for the _refer parameter in wp-admin/users.php when update=confirm_delete, enabling an unauthenticated attacker to craft a link that executes arbitrary HTML/script in t...

WordPress Ultimate Member Plugin <= 1.3.75 - Unauthenticated Change Passwords

This plugin is prone to an unauthenticated change passwords vulnerability. Solution Update the plugin...

Ultimate Member < 1.3.76 - Unauthenticated Change Passwords

Ultimate Member versions below 1.3.76 contain a critical security issue that allows unauthenticated users to reset any users password to an arbitrary value...

WordPress Ultimate Member 1.3.64 Local File Inclusion

------------------------------------------------------------------------ Ultimate Member Local File Inclusion vulnerability ------------------------------------------------------------------------ Burak Kelebek, July 2016 ------------------------------------------------------------------------...

Ultimate Member < 1.3.65 - Local File Inclusion

It was discovered that Ultimate Member is vulnerable to PHP File Inclusion. In order to exploit this issue an attacker must be able to place an arbitrary PHP file on the target system. Afterwards the attacker needs to lure an authenticated admin to visit a malicious page. Through CSRF the attacke...

WordPress Ultimate Member Plugin <= 1.3.64 - Local File Inclusion

This plugin is prone to a PHP file inclusion vulnerability. Solution Update the plugin...

Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Ultimate Member WordPress插件反射型跨站脚本漏洞

No description provided by source...

WordPress Ultimate Member 1.3.28 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Ultimate Member WordPress plugin Vendor: Ultimate Member Vulnerable Versions: 1.3.28 and probably prior Tested Version: 1.3.28 Advisory Publication: October 29, 2015 without technical details Vendor Notification: October 29, 2015 Vend...

Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

WordPress Ultimate Member 1.3.28 Cross Site Scripting

Advisory ID: HTB23277 Product: Ultimate Member WordPress plugin Vendor: Ultimate Member Vulnerable Versions: 1.3.28 and probably prior Tested Version: 1.3.28 Advisory Publication: October 29, 2015 without technical details Vendor Notification: October 29, 2015 Vendor Patch: October 31, 2015 Publi...

WordPress Ultimate Member Plugin <= 1.3.28 - Reflected Cross Site Scripting

Because of this vulnerability, attackers cat steal administrator's cookies, credentials and browser history and modify web page content to perform phishing attacks. Solution Update the plugin...

Ultimate Member WordPress Plugin Reflective Cross-Site Scripting Vulnerability

Ultimate Member is a plugin for creating online communities and user templates for WordPress. Ultimate Member 1.3.28 and earlier versions do not effectively filter the value of the "refer" HTTP GET parameter of "wp-admin/users.php" when "update" is set to "confirmdelete", which allows an...

WordPress Ultimate Member 'class.p.php' plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Ultimate Member 'class.p.php' plugin due to the program failing to adequately filter user-supplied inpu...

Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)

The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this...

Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)

The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this...

WordPress Ultimate Member Plugin <= 1.2.994 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because attackers load data from a location. After that, data from that location is output on the target domain and JavaScript is executed under the context of the current user of the site. Solution Update the plugin...

WordPress Ultimate Member Plugin <= 1.0.78 - Multiple Vulnerabilities

Because of multiple vulnerabilities in this plugin, attackers can delete any file or upload arbitrary files. Solution Update the plugin...