7 matches found
CVE-2018-0589
CVE-2018-0589 affects the WordPress plugin Ultimate Member, prior to version 2.0.4. The vulnerability enables a remote authenticated attacker to bypass access restrictions on the plugin and add a new form via the plugin’s Forms page. The issue is an access restriction bypass (CWE-284) and is repo...
CVE-2018-0590
CVE-2018-0590 affects the WordPress plugin Ultimate Member, prior to version 2.0.4. The vulnerability allows remote authenticated attackers to bypass access restrictions and modify other users’ profiles via unspecified vectors due to an access‑control bypass in the plugin (CWE-284). Affected vers...
CVE-2018-0588
CVE-2018-0588 is a directory traversal in the AJAX function of the WordPress plugin Ultimate Member, affecting versions prior to 2.0.4. The vulnerability allows remote attackers to read arbitrary files on the server via unspecified vectors. Multiple connected sources corroborate this issue and li...
CVE-2018-0587
Summary: CVE-2018-0587 affects the WordPress plugin Ultimate Member prior to version 2.0.4. The vulnerability is described as an arbitrary file upload that allows a remote authenticated user to upload arbitrary image files via unspecified vectors. The related documents consistently tie this to th...
CVE-2018-10234
CVE-2018-10234: Authenticated Cross-Site Scripting in the WordPress User Profile & Membership plugin prior to 2.0.11, exploitable via the Account Deletion Custom Text field on wp-admin/admin.php?page=um_options§ion=account. Impact is XSS authenticated users; remediation is to update to 2.0.11...
CVE-2018-10233
CVE-2018-10233 affects the WordPress User Profile & Membership plugin (Ultimate Member) before 2.0.7. A CSRF flaw with no mitigations is present throughout the plugin, potentially allowing unauthorized operations. Affected component: the plugin’s core/profile/membership functions; root cause: lac...