PT-2019-10401 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate-member plugin versions prior to 2.0.4 Description: The issue is related to a Cross-Site Scripting XSS problem. Recommendations: For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue...

Ultimate Member <= 2.0.53 - Cross-Site Scripting (XSS)

The changelog states: "Added security fixes XSS"...

WordPress Ultimate Member Plugin < 2.0.40 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Ultimate Member plugin <= 2.0.51 - Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Stored Cross-Site Scripting XSS vulnerabilities found by m0ns7er in WordPress Ultimate Member plugin versions = 2.0.51. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.52...

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

Design/Logic Flaw

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

CVE-2019-10271

The CVE-2019-10271 entry corresponds to a vulnerability in the WordPress Ultimate Member plugin (version 2.39) that allows unauthorized modification of profile and cover pictures. The underlying issue enables an authenticated attacker to modify the profile and cover images of any user, including ...

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged user...

Ultimate Member < 2.0.52 - CSRF and Stored XSS issues

A CSRF vulnerability in adding/editing user roles in Ultimate Member 2.0.49. It also lead to stored XSS. Edit WPScanTeam: July 9th, 2019 - v2.0.50 released and still affected. Escalated to WP Plugins Team July 9th, 2019 - v2.0.51 released, fixing the CSRF but not the XSS July 11th, 2019 - Escalat...

Ultimate Member < 2.0.52 - CSRF and Stored XSS issues

A CSRF vulnerability in adding/editing user roles in Ultimate Member 2.0.49. It also lead to stored XSS. Edit WPScanTeam: July 9th, 2019 - v2.0.50 released and still affected. Escalated to WP Plugins Team July 9th, 2019 - v2.0.51 released, fixing the CSRF but not the XSS July 11th, 2019 - Escalat...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

Design/Logic Flaw

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...

CVE-2019-10270

Affected software: WordPress Ultimate Member plugin. Vulnerable component: password reset flow in Ultimate Member (versions around 2.39; OpenVAS references

PT-2019-11674 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 for WordPress Description: An issue was discovered in the password reset functionality, allowing an attacker to reset the password of another user without proper verification. This is possible because the...

Ultimate Member Plugin for WordPress < 2.0.46 Multiple Vulnerabilities

The WordPress Ultimate Member Plugin installed on the remote host is affected by multiple vulnerabilities : - An arbitrary file read and delete vulnerability. - A Cross-Site Scripting XSS vulnerability exists due to improper validation of user-supplied input in admin dashboard. - A Cross-Site...

WordPress Ultimate Member plugin <= 2.0.45 - Multiple vulnerabilities

Multiple vulnerabilities found by Antony Garand Sucuri team in WordPress Ultimate Member plugin versions = 2.0.45. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.46...

Ultimate Member < 2.0.46 - Multiple Vulnerabilities

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...