Authentication flaw

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors...

Unrestricted file upload

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors...

Authentication flaw

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2018-0590

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

CVE-2018-0586

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...

CVE-2018-0587

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors...

CVE-2018-0588

Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2018-0586

Ultimate Member for WordPress

CVE-2018-0587

Summary: CVE-2018-0587 affects the WordPress plugin Ultimate Member prior to version 2.0.4. The vulnerability is described as an arbitrary file upload that allows a remote authenticated user to upload arbitrary image files via unspecified vectors. The related documents consistently tie this to th...

CVE-2018-0588

CVE-2018-0588 is a directory traversal in the AJAX function of the WordPress plugin Ultimate Member, affecting versions prior to 2.0.4. The vulnerability allows remote attackers to read arbitrary files on the server via unspecified vectors. Multiple connected sources corroborate this issue and li...

CVE-2018-0590

CVE-2018-0590 affects the WordPress plugin Ultimate Member, prior to version 2.0.4. The vulnerability allows remote authenticated attackers to bypass access restrictions and modify other users’ profiles via unspecified vectors due to an access‑control bypass in the plugin (CWE-284). Affected vers...

CVE-2018-0589

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors...

CVE-2018-0585

Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2018-0589

CVE-2018-0589 affects the WordPress plugin Ultimate Member, prior to version 2.0.4. The vulnerability enables a remote authenticated attacker to bypass access restrictions on the plugin and add a new form via the plugin’s Forms page. The issue is an access restriction bypass (CWE-284) and is repo...

CVE-2018-0585

CVE-2018-0585 is a cross-site scripting vulnerability in the WordPress

PT-2018-8944

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin versions prior to 2.0.4 Description The issue allows remote authenticated attackers to read arbitrary files due to a directory traversal vulnerability in the shortcodes function. Recommendations For versions prior to...

CVE-2018-0590: Undefined Security Weakness

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

CVE-2018-0589: Undefined Security Weakness

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via unspecified vectors...