Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
UltimatememberUltimate Member

10 matches found

CVE
CVE•added 2022/06/13 1:15 p.m.•97 views

CVE-2022-1208

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected b...

6.4CVSS5.1AI score0.00267EPSS
CVE
CVE•added 2019/08/12 4:15 p.m.•65 views

CVE-2015-9304

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

6.1CVSS6AI score0.00264EPSS
CVE
CVE•added 2025/02/21 10:15 a.m.•48 views

CVE-2024-12276

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection via filenames in all versions up to, and including, 2.9.2 due to insufficient escaping on the user supplied parameter a...

6.5CVSS5.3AI score0.00023EPSS
CVE
CVE•added 2017/09/11 8:29 p.m.•44 views

CVE-2015-8354

Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.

6.1CVSS6.1AI score0.00533EPSS
CVE
CVE•added 2018/10/09 10:29 p.m.•38 views

CVE-2018-17866

Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

6.1CVSS6.1AI score0.00352EPSS
CVE
CVE•added 2018/02/16 2:29 p.m.•36 views

CVE-2018-6944

core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.

6.1CVSS6AI score0.00285EPSS
CVE
CVE•added 2018/07/04 8:29 a.m.•35 views

CVE-2018-13136

The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.

6.1CVSS6AI score0.00347EPSS
CVE
CVE•added 2019/08/12 4:15 p.m.•34 views

CVE-2018-20965

The ultimate-member plugin before 2.0.4 for WordPress has XSS.

6.1CVSS6.3AI score0.00345EPSS
CVE
CVE•added 2024/10/04 5:15 a.m.•34 views

CVE-2024-8519

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitiz...

6.4CVSS5.5AI score0.00152EPSS
CVE
CVE•added 2019/08/12 4:15 p.m.•32 views

CVE-2016-10872

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

6.1CVSS6AI score0.00311EPSS