Now officially on WordPress.org

CVE Database / CVE-2018-0585

CVE · Medium

CVE-2018-0585 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.4 < 2.0.4 2.0.4 2018-05-10 —

CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589

Ultimate Member plugin versions before 2.0.4 contain multiple security flaws including cross-site scripting, directory traversal vulnerabilities in both shortcodes and AJAX functions, arbitrary file upload capability, and access control bypasses affecting the Forms page and role-based processing. These vulnerabilities were discovered by Gen Sato of Mitsui Bussan Secure Directions, Inc. and coordinated through JPCERT/CC. Users should upgrade to version 2.0.4 or later to address these issues.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings