Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: ultimatemember Component: User Profile & Membership Clear all filters
TI-2018-00545 CVE-2018-0588 · GHSA-m5gh-j9fw-88fp

Path traversal in ultimatemember Ultimate Member

Priority LOW 38

Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0251 Published 2018-05-14 No fix listed CWE-22
TI-2018-00544 CVE-2018-0587 · GHSA-m2cc-xh6j-cr9r

Unrestricted file upload in ultimatemember Ultimate Member

Priority LOW 22

Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01041 Published 2018-05-14 No fix listed CWE-434
TI-2018-00543 CVE-2018-0586 · GHSA-rvx3-q3j6-9h4q

Path traversal in ultimatemember Ultimate Member

Priority LOW 23

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.

CVSS 3.0MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01553 Published 2018-05-14 No fix listed CWE-22
TI-2018-07258 CVE-2018-10234 · GHSA-4c2w-x5ww-3v7m

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before…

Priority LOW 23

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account p…

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00619 Published 2018-04-23 No fix listed CWE-79