Ultimatemember User Profile \& Membership
7 CVEs affecting Ultimatemember User Profile \& Membership. Latest disclosed: 2018-05-14. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10233 | High | 8.8 | 2018-04-23 | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural… |
CVE-2018-0588 | High | 7.5 | 2018-05-14 | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary… |
CVE-2018-10234 | Medium | 4.8 | 2018-04-23 | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fiel… |
CVE-2018-0590 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profil… |
CVE-2018-0589 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms'… |
CVE-2018-0587 | Medium | 4.3 | 2018-05-14 | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary ima… |
CVE-2018-0586 | Medium | 4.3 | 2018-05-14 | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attacke… |