Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, 017d7dc2b798babc4073058ca4dfded9a3ea0a96

CVE, Research URL: 017d7dc2b798babc4073058ca4dfded9a3ea0a96
Home page URL: Security reports for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Application: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Published on: Jul 15, 2022
Research Description: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.1 Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘website’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the username of an affected user.
Affected versions: max 2.4.1.
Status: vulnerable

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin, 017d7dc2b798babc4073058ca4dfded9a3ea0a96