CVE-2022-1208CWE-79

Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting

Medium · published June 13, 2022

CVSS v3.1
6.4
EPSS
1%
Percentile
59.4
In the wild
Unconfirmed
What it is

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00904 · 59.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-06-13T12:43Z
EPSS history
Timeline
  • 13 JUN 12:43Z
    Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
    cvelistv5