Ultimate Member Vulnerabilities and Affected Products
Vulnerabilities associated with Ultimate Member – User Profile, User Registration, Login & Membership Plugin.
Products
Clear product- Ultimate Member8 vulnerabilities
- ForumWP2 vulnerabilities
- ultimate_member2 vulnerabilities
- Ultimate Member – User Profile, User Registration, Login & Membership Plugin1 vulnerability
- ultimate-member1 vulnerability
- User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-24306MEDIUM | Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link. CWE-79May 24, 2021 | CVSS5.4v3.1 | EPSS0.62% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |