CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10234 – Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-10234
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page. Existe Cross-Site Scripting (XSS) autenticado en el plugin User Profile Membership, en versiones anteriores a la 2.0.11 para WordPress, mediante el campo de entrada "Account Deletion Custom Text" en la página wp-admin/admin.php?page=um_optionssection=account. • https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10234 https://wordpress.org/plugins/ultimate-member/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-10233 – Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues
https://notcve.org/view.php?id=CVE-2018-10233
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin. El plugin User Profile Membership, en versiones anteriores a la 2.0.7 para WordPress, no tiene ninguna mitigación implementada contra ataques de Cross-Site Request Forgery (CSRF). Este problema está presente en todo el plugin. • https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10233 https://wordpress.org/plugins/ultimate-member/#developers https://wpvulndb.com/vulnerabilities/9611 • CWE-352: Cross-Site Request Forgery (CSRF) •