Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, 3b6a5da0-511d-46f7-9b55-64d771b633a7
- CVE, Research URL
- Published on
- -
- Research Description
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] >= 1.2.98 - <= 1.2.994 Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS) The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this location is then output on the target domain, and as such JavaScript is executed under the context of the current user of the site.
- Affected versions
-
Min 1.2.98, max 1.2.994.
- Status
-
vulnerable