CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-6943 – Ultimate Member <= 2.0.3 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-6943
core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable. core/lib/upload/um-image-upload.php en el plugin UltimateMember 2.0 para WordPress tiene una vulnerabilidad de Cross-Site Scripting (XSS) debido a que fracasa a la hora de sanear las entradas del usuario que se pasan a la variable $temp. WordPress UltimateMember plugin version 2.0 suffers from multiple cross site scripting vulnerabilities. • https://packetstormsecurity.com/files/146403/WordPress-UltimateMember-2.0-Cross-Site-Scripting.html https://wpvulndb.com/vulnerabilities/9705 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10872 – Ultimate Member <= 1.3.39 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10872
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. El plugin ultimate-member anterior a la versión 1.3.40 para WordPress tiene XSS en el formulario de inicio de sesión. • https://wordpress.org/plugins/ultimate-member/#developers https://wpvulndb.com/vulnerabilities/9738 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-8354 – Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-8354
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el plugin Ultimate Member en versiones anteriores a la 1.3.29 para WordPress permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el parámetro the _refer en wp-admin/users.php. WordPress Ultimate Member plugin version 1.3.28 suffers from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/134601/WordPress-Ultimate-Member-1.3.28-Cross-Site-Scripting.html http://www.securityfocus.com/archive/1/537021/100/0/threaded https://wpvulndb.com/vulnerabilities/8346 https://www.htbridge.com/advisory/HTB23277 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9304 – Ultimate Member <= 1.3.17 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9304
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. El plugin ultimate-member anterior a la versión 1.3.18 para WordPress tiene XSS a través de la entrada de texto. • https://wordpress.org/plugins/ultimate-member/#developers https://wpvulndb.com/vulnerabilities/9764 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •