Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, f0b7bac389d191b33ebe4419d9c39e0349dc2f3a

CVE, Research URL: f0b7bac389d191b33ebe4419d9c39e0349dc2f3a
Home page URL: Security reports for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Application: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Published on: May 13, 2019
Research Description: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file's name from a user profile upload in versions up to, and including, 2.0.45 due to insufficient input sanitization and output escaping. This makes it possible for low-level authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 2.0.46.
Status: vulnerable

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin, f0b7bac389d191b33ebe4419d9c39e0349dc2f3a