CVE Database /
CVE-2021-24306
CVE · Medium
CVE-2021-24306 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.20
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24306
|
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.20 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.1.20
|
2.1.20 |
2021-05-07 |
—
|
CVE-2021-24306
The Ultimate Member plugin prior to version 2.1.20 contains an authenticated reflected cross-site scripting vulnerability in the user profile edit link functionality. The plugin fails to adequately sanitize, validate, and encode the query string parameters used when constructing links for users to edit their own profiles. An attacker with knowledge of a target username could craft a malicious link that, when clicked by an authenticated user, executes arbitrary JavaScript in their browser session.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings