Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

CVE-2020-35650

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

CVE-2020-35650

CVE-2020-35650 affects Uncanny Groups for LearnDash prior to v3.7, with multiple XSS vectors enabled by authenticated users. The vulnerability exists in various input points (POST parameters like ulgm_code_redeem, ulgm_user_first/last/email, ulgm_code_registration, ulgm_terms_conditions, _ulgm_to...