Ultimate Member

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Untrusted deserialization may create PHP objects; code execution requires a usable gadget chain and its prerequisites, neither of which is established by this record. The structured affected range is <= 2.13.1.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations. The vector marks UI:N, but the narrative’s victim viewing or interaction requirement still applies. Exploitation requires the victim interaction described above; merely storing the payload is not sufficient. The structured affected range is <= 2.14.0.

The supplied vector requires no attacker account. An incorrect privilege assignment can give a caller access beyond the intended authorization boundary. The export does not identify the endpoint, input, assigned privilege, account requirement beyond the unauthenticated vector, or target role. The limited-impact vector does not establish unrestricted Administrator takeover. No victim interaction is required by the vector. The vector reports limited confidentiality impact, limited integrity impact, limited availability impact. The vector also reports high attack complexity; the export establishes only the preconditions described here. Affected versions: <= 2.13.1. The authoritative export identifies 2.14.0 as fixed for this CVE.

Ultimate Member through 2.13.1 permits privilege escalation by accepting a user-controlled key without adequate authorization. The CVSS vector requires low privileges and no victim interaction, but the authoritative export does not identify a minimum WordPress role, target privilege, endpoint, parameter name or function. The exact input-to-operation path is not disclosed. The authoritative export identifies the fixed release as 2.14.0.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html(). The official changelog confirms the fixed release as 2.14.0.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements. The official changelog confirms the fixed release as 2.14.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1. The supplied CVSS vector requires high privileges; the minimum WordPress role is not identified. Attacker-controlled input affects a database query and allows information to be inferred through a blind SQL injection channel. The parameter, query and inference channel are not identified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 2.14.0.

An attacker able to register an account supplies a malicious profile name. HTML entities are decoded after sanitization and the result is emitted unescaped in the profile page title, executing script when another visitor or administrator views that profile. Registration is a prerequisite even though the record describes the attacker as unauthenticated. The exact rendering function is not disclosed. Authoritative affected range: < 2.13.1. Confirmed remediation: 2.13.1.

Ultimate Member before 2.13.0 does not check comment approval or profile privacy before returning profile activity. An unauthenticated visitor can read comments that are still awaiting moderation, including activity belonging to private profiles.

Ultimate Member 2.6.7 through 2.12.x validates a submitted registration role against all registered site roles when it cannot resolve the form's own allow-list. An unauthenticated registrant can select a role with arbitrary capabilities and reach administrator-equivalent access.

Ultimate Member through 2.12.1 lets a Subscriber store a quote-breakout payload in the id attribute of an HTML-enabled textarea profile field. The allowed div attribute survives wp_kses processing, then pickadate.js concatenates the stored id into HTML through jQuery .html(), allowing autofocus and onfocus syntax to execute JavaScript when the profile loads.

Ultimate Member before 2.12.1 does not remove administrator-level capabilities from roles made selectable on registration forms, and its post-registration safeguard against elevated accounts is disabled by default. If a published registration form includes a role-selection field and the site has a custom role carrying administrator capabilities, an unauthenticated visitor can choose that role during registration and receive administrative access. The published.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.10.1.

Ultimate Member is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 2.12.0.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.11.4.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated contributor account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.11.4.

ultimate-member is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is 2.1.3.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated contributor account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.11.2.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

Ultimate Member is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Ultimate Member is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Ultimate Member is affected by code execution. Exploitation requires an authenticated WordPress account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Ultimate Member is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member – User Profile, User Registration, Login & Membership Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

Ultimate Member is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

Ultimate Member is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

Ultimate Member is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

profile edit form in the Ultimate Member is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Ultimate Member is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Ultimate Member is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Ultimate Member is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.