WordPress Plugin Vulnerabilities

Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)

Description

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
ultimate-member
Fixed in 1.3.40

References

CVE
CVE-2016-10872

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Verified
No
WPVDB ID
4a26919e-055a-4173-b689-0d2705ff48e2

Timeline

Publicly Published
2016-04-06 (about 9 years ago)
Added
2019-08-24 (about 6 years ago)
Last Updated
2020-08-12 (about 5 years ago)

Other

Published
Title
Published
2023-03-27
Title
Easy Forms for MailChimp < 6.8.7 - Contributor+ Stored XSS
Published
2024-03-11
Title
WooCommerce Product Filter < 1.4.4 - Reflected XSS
Published
2025-09-05
Title
Admin Menu Editor < 1.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter
Published
2024-12-16
Title
Animated Counters <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2021-06-13
Title
WP DoNotTrack <= 0.8.8 - Authenticated (admin+) Stored XSS