CVE-2022-1209

The CVE concerns the WordPress plugin Ultimate Member, vulnerable up to version 2.3.1 due to insufficient validation of URLs in the social fields on the Profile Page, enabling arbitrary redirects. Affected component: Ultimate Member plugin for WordPress; root cause: open redirect caused by improp...

CVE-2022-1209 Ultimate Member <= 2.3.1 - Arbitrary Redirect

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1...

CVE-2022-1209 Ultimate Member <= 2.3.1 - Arbitrary Redirect

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1...

PT-2022-13713 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member plugin for WordPress versions up to, and including, 2.3.1 Description: The issue is related to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page. This makes it...

WordPress plugin Ultimate Member 输入验证错误漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The Ultimate Member plugin is a plugin used to create membership sites or online communities. The vulnerability redirects users to malicious websites for phishing and other attacks...

CVE-2022-29424

Authenticated admin or higher user role Reflected Cross-Site Scripting XSS vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin = 9.7.1 at WordPress...

WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Nguy Minh Tuan Patchstack Alliance in WordPress Image Hover Effects Ultimate plugin versions = 9.7.1. Solution Update the WordPress Image Hover Effects Ultimate plugin to the latest available version at least 9.7.2...

WordPress Ultimate Member plugin <= 2.3.1 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Ruijie Li in WordPress Ultimate Member plugin versions = 2.3.1. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.3.2...

Ultimate Member < 2.3.2 - Open Redirect

The plugin is vulnerable to open redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims...

WordPress Ultimate Reviews plugin cross-site scripting vulnerability

WordPress plugin is a WordPress application plugin. WordPress Ultimate Reviews plugin 3.0.15 and earlier versions contain a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit this vulnerability to...

CVE-2022-0360

The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones either intentionnaly or not and lead to Stored Cross-Site Scripting issues...

CVE-2022-0360

CVE-2022-0360 affects the WordPress plugin WP Ultimate CSV Importer (versions prior to 6.4.3). The root cause is failure to sanitise and escape imported comments, enabling stored Cross-Site Scripting (XSS) by high-privilege users who import malicious comments. Documented evidence shows an admin+ ...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of WordPress WP Ultimate CSV Importer plugin prior to 6.4.3...

WordPress Ultimate Post Kit – Addons For Elementor plugin < 2.9.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Post Kit – Addons For Elementor plugin versions 2.9.1. Solution Update the WordPress Ultimate Post Kit – Addons For Elementor plugin to the latest available version at least 2.9.1...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin < 2.4.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin versions 2.4.13. Solution Update the WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin to the latest available version at least 2.4.13...

WordPress Ultimate Post Kit – Addons For Elementor plugin < 2.9.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Post Kit – Addons For Elementor plugin versions 2.9.1. Solution Update the WordPress Ultimate Post Kit – Addons For Elementor plugin to the latest available version at least 2.9.1...

WordPress Ultimate Carousel For Divi plugin <= 4.3.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Carousel For Divi plugin versions = 4.3.0. Solution Update the WordPress Ultimate Carousel For Divi plugin to the latest available version at least 4.3.1...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin < 2.4.13 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin versions 2.4.13. Solution Update the WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin to the latest available version at least 2.4.13...

WordPress Ultimate Widgets Light plugin <= 1.5.9.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Widgets Light plugin versions = 1.5.9.4. Solution No patched version available...

PT-2022-13125 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer WordPress plugin versions prior to 6.4.3 Description: The issue allows high privilege users to import malicious comments, potentially leading to Stored Cross-Site Scripting issues, due to the lack of sanitization and...