WordPress Plugin Vulnerabilities

Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS)

Description

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
ultimate-member
Fixed in 1.3.29

References

CVE
CVE-2015-8354
URL
https://seclists.org/bugtraq/2015/Dec/7
URL
https://www.immuniweb.com/advisory/HTB23277

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.4 (medium)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
2d2a1116-85fa-4dc1-9d2b-bc6e7f786e34

Timeline

Publicly Published
2015-12-02 (about 10 years ago)
Added
2015-12-02 (about 10 years ago)
Last Updated
2020-08-12 (about 5 years ago)

Other

Published
Title
Published
2023-04-19
Title
Category Specific RSS feed Subscription < 2.3 - Admin+ Stored XSS
Published
2022-02-28
Title
SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting
Published
2024-07-06
Title
Simple Social Share <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2019-09-27
Title
Zoner < 4.2 - Persistent XSS & IDOR
Published
2022-05-17
Title
WP Athletics <= 1.1.7 - Subscriber+ Stored Cross-Site Scripting