CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2022-3384 – Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
https://notcve.org/view.php?id=CVE-2022-3384
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server. El complemento Ultimate Member para WordPress es vulnerable a la ejecución remota de código en versiones hasta la 2.5.0 incluida a través de la función populate_dropdown_options que acepta la entrada proporcionada por el usuario y la pasa a través de call_user_func(). Esto está restringido a funciones PHP sin parámetros como phpinfo(); ya que los parámetros proporcionados por el usuario no se pasan a través de la función. • https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3383%20%26%26%20CVE-2022-3384.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3384 https://www.yuque.com/docs/share/8796eef9-ac4c-4339-96b4-6c21313ecf3e • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2022-1209 – Ultimate Member <= 2.3.1 - Arbitrary Redirect
https://notcve.org/view.php?id=CVE-2022-1209
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1. El plugin Ultimate Member para WordPress es vulnerable a redireccionamientos abiertos debido a una comprobación insuficiente de las URL suministradas en los campos social de la Página de Perfil, lo que hace posible que atacantes redirijan a víctimas desprevenidas en versiones hasta la 2.3.1 incluyéndola, concediendo a la víctima un clic en un icono social en la página de perfil de un usuario • https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md https://github.com/ultimatemember/ultimatemember/issues/989 https://github.com/ultimatemember/ultimatemember/pull/990 https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1208 – Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1208
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2. El plugin Ultimate Member para WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado por medio del campo Biography que aparece en las páginas de perfil de usuarios individuales debido a un saneo insuficiente de la entrada y escape de la salida que permite a usuarios codificar scripts web maliciosos con codificación HTML que es reflejada en la página. Esto afecta a versiones hasta la 2.3.2 incluyéndola. • https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Stored%20Cross-Site%20Scripting.md https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2735896%40ultimate-member&new=2735896%40ultimate-member&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1208 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24306 – Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-24306
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link. El plugin de WordPress Ultimate Member - User Profile, User Registration, Login & Membership Plugin versión anterior a 2.1.20, no saneaba, validaba ni codificaba apropiadamente la cadena de consulta cuando genera un enlace para editar el perfil del usuario, lo que generaba un problema de tipo Cross-Site Scripting reflejado autenticado. Es requerido el conocimiento del nombre de usuario objetivo para explotar esto, y los atacantes tendrían que hacer que el usuario conectado relacionado abra un enlace malicioso • https://wpscan.com/vulnerability/35516555-c50c-486a-886c-df49c9e51e2c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36170 – Ultimate Member <= 2.1.12 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-36170
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. El plugin Ultimate Member versiones anteriores a 2.1.13 para WordPress, maneja inapropiadamente los campos name="timestamp" ocultos en los formularios • https://wordpress.org/plugins/ultimate-member/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •