CVE-2022-1209CWE-601

Ultimate Member <= 2.3.1 - Arbitrary Redirect

Medium · published May 10, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00731 · 53.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2022-05-10T19:34Z
EPSS history
Timeline
  • 10 MAY 19:34Z
    Ultimate Member <= 2.3.1 - Arbitrary Redirect
    cvelistv5