20 matches found
CVE-2026-14568: Improper Authentication
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...
CVE-2021-24955: Improper Neutralization of Input During Web Page Generation
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24954: Improper Neutralization of Input During Web Page Generation
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppressccdata parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue...
PT-2021-16384
Name of the Vulnerable Software and Affected Versions: User Registration, Login Form, User Profile & Membership WordPress plugin versions prior to 3.2.3 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the data parameter of the pp get forms by build...
PT-2021-16383
Name of the Vulnerable Software and Affected Versions: User Registration, Login Form, User Profile & Membership WordPress plugin versions prior to 3.2.3 Description: The issue arises from the failure to sanitise and escape the ppress cc data parameter before outputting it back in an attribute of ...
CVE-2018-17866
Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...
CVE-2018-17866: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...
PT-2018-14233
Name of the Vulnerable Software and Affected Versions Ultimate Member - User Profile & Membership plugin versions prior to 2.0.28 Description The issue allows remote attackers to inject arbitrary web script or HTML via the Primary button Text or Second button text field, potentially leading to...
WordPress User Profile&Membership Plugin Cross-Site Request Forgery Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports PHP and MySQL server set up a personal blog site.User Profile&Membership plugin is used in one of the website membership registration plugin. A cross-site request forger...
WordPress User Profile&Membership Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports PHP and MySQL server set up a personal blog site.User Profile&Membership plugin is used in one of the website membership registration plugin. A cross-site scripting...
CVE-2018-10233
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin...
CVE-2018-10233
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin...
Cross site scripting
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-10233
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin...
CVE-2018-10234
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-10234
CVE-2018-10234: Authenticated Cross-Site Scripting in the WordPress User Profile & Membership plugin prior to 2.0.11, exploitable via the Account Deletion Custom Text field on wp-admin/admin.php?page=um_options§ion=account. Impact is XSS authenticated users; remediation is to update to 2.0.11...
PT-2018-9773
Name of the Vulnerable Software and Affected Versions: User Profile & Membership plugin versions prior to 2.0.7 Description: The issue concerns the lack of mitigations against cross-site request forgery attacks in the plugin. This is a structural finding throughout the entire plugin, indicating a...
CVE-2018-10233: Cross-Site Request Forgery (CSRF)
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin...
CVE-2018-10234: Improper Neutralization of Input During Web Page Generation
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
PT-2018-9774
Name of the Vulnerable Software and Affected Versions: User Profile & Membership plugin versions prior to 2.0.11 Description: An issue exists in the User Profile & Membership plugin for WordPress, where authenticated cross-site scripting is possible. This is due to a vulnerability in the Account...