Ultimate Member Security Vulnerabilities and Issues — Ultimate Member CVE List

Lucene search

UltimatememberUltimate Member

9 matches found

CVE•added 2019/06/21 6:15 p.m.•346 views

CVE-2019-10270

An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset the password of another user. One only needs to know the use...

8.8CVSS8.8AI score0.00177EPSS

CVE•added 2019/06/24 7:15 p.m.•87 views

CVE-2019-10271

An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users....

4.3CVSS5.4AI score0.00234EPSS

CVE•added 2019/08/12 4:15 p.m.•65 views

CVE-2015-9304

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

6.1CVSS6AI score0.00264EPSS

CVE•added 2019/04/03 5:29 a.m.•55 views

CVE-2019-10673

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the ad...

9.3CVSS8.8AI score0.00428EPSS

CVE•added 2019/08/12 4:15 p.m.•48 views

CVE-2019-14945

The ultimate-member plugin before 2.0.54 for WordPress has XSS.

5.4CVSS5.5AI score0.00685EPSS

CVE•added 2019/08/12 4:15 p.m.•45 views

CVE-2019-14946

The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

5.4CVSS5.2AI score0.00458EPSS

CVE•added 2019/08/12 4:15 p.m.•45 views

CVE-2019-14947

The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.