https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:30:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-4248 <p><strong>Affected:</strong> ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin</p> <p>The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the &#39;{usermeta:password_reset_link}&#39; template tag being processed within post content via the &#39;[um_loggedin]&#39; shortcode, which generates a valid password reset token for the currently logged-in user viewing the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to craft a malicious pending post that, when previewed by an Administrator, generates a password reset token for the Administrator and exfiltrates it to an attacker-controlled server, leading to full account takeover.</p> <p><strong>Affected:</strong> ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin</p> <p>The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the &#39;{usermeta:password_reset_link}&#39; template tag being processed within post content via the &#39;[um_loggedin]&#39; shortcode, which generates a valid password reset token for the currently logged-in user viewing the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to craft a malicious pending post that, when previewed by an Administrator, generates a password reset token for the Administrator and exfiltrates it to an attacker-controlled server, leading to full account takeover.</p> https://cve.radiocsirt.org/vuln/cve-2026-4248