WordPress Plugin Vulnerabilities

Ultimate Member < 2.0.18 - Authenticated Cross-Site Scripting (XSS)

Description

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Affects Plugins

Plugin icon
ultimate-member
Fixed in 2.0.18

References

CVE
CVE-2018-13136

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.4 (high)

Miscellaneous

Verified
No
WPVDB ID
f6fca349-013a-4ca7-9c91-4deb7f0127b7

Timeline

Publicly Published
2018-07-03 (about 7 years ago)
Added
2019-08-24 (about 6 years ago)
Last Updated
2020-08-12 (about 5 years ago)

Other

Published
Title
Published
2022-01-03
Title
SVG Support < 2.3.20 - Admin+ Stored Cross-Site Scripting
Published
2023-11-29
Title
Parallax Slider Block < 1.2.6 - Author+ Stored XSS
Published
2023-08-17
Title
Modal Dialog < 3.5.15 - Reflected XSS
Published
2025-01-16
Title
visualslider Sldier < 1.4 - Reflected Cross-Site Scripting
Published
2025-01-24
Title
Atarim < 4.0.9 - Unauthenticated Stored Cross-Site Scripting