Now officially on WordPress.org

CVE Database / CVE-2022-1208

CVE · Medium

CVE-2022-1208 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-1208 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.4 < 2.4.0 2.4.0 2022-03-21 —

CVE-2022-1208

The Ultimate Member plugin for WordPress through version 2.3.2 contains a stored cross-site scripting vulnerability in the Biography field on user profile pages. Attackers can inject malicious scripts encoded in HTML that bypass insufficient sanitization checks and execute when the field is displayed. The vulnerability stems from a lack of proper output escaping, and while version 2.3.2 attempted a partial fix, the issue was not completely resolved until version 2.4.0.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings