Most recent entries from all

cnvd-2018-10658

EUVD-2026-60843

fkie_cve-2018-0585

Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

GHSA-42x4-79w3-22pp

Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

gsd-2018-0585

jvndb-2018-000045

The WordPress plugin "Ultimate Member" provided by Ultimate Member contains multiple vulnerabilities listed below. * Cross-site Scripting (CWE-79) - CVE-2018-0585 * Directory Traversal in the shortcodes function (CWE-22) - CVE-2018-0586 * Arbitrary File Upload (CWE-434) - CVE-2018-0587 * Directory Traversal in the AJAX function (CWE-22) - CVE-2018-0588 * Access Restriction Bypass in the "Forms" page (CWE-284) - CVE-2018-0589 * Access Restriction Bypass due to an issue in processing "Role" (CWE-284) - CVE-2018-0590 Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.