Read the docs

ultimatemember

Records77All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9

Exploited now

ultimatemember records in CISA KEV

No ultimatemember vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ultimate Member 37 records CRITICAL User Profile & Membership 7 records LOW Forumwp 4 records MEDIUM Jobboardwp 4 records HIGH Ultimatemember 1 record LOW

Records

7 records in User Profile & Membership · all components

TI-2018-00545 CVE-2018-0588 · GHSA-m5gh-j9fw-88fp

Path traversal in ultimatemember Ultimate Member

Priority LOW 38

Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0251 Published 2018-05-14 No fix listed CWE-22
TI-2018-07258 CVE-2018-10234 · GHSA-4c2w-x5ww-3v7m

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before…

Priority LOW 23

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account p…

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00619 Published 2018-04-23 No fix listed CWE-79
TI-2018-00543 CVE-2018-0586 · GHSA-rvx3-q3j6-9h4q

Path traversal in ultimatemember Ultimate Member

Priority LOW 23

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01553 Published 2018-05-14 No fix listed CWE-22
TI-2018-00544 CVE-2018-0587 · GHSA-m2cc-xh6j-cr9r

Unrestricted file upload in ultimatemember Ultimate Member

Priority LOW 22

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01041 Published 2018-05-14 No fix listed CWE-434
Open these records in search →