CVE-2018-17866

Опубликовано: 09 окт. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.

Ссылки

https://serhack.me/articles/ultimate-member-xss-security-issue
Exploit
Third Party Advisory
https://wordpress.org/plugins/ultimate-member/#developers
Product
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9615
https://serhack.me/articles/ultimate-member-xss-security-issue
Exploit
Third Party Advisory
https://wordpress.org/plugins/ultimate-member/#developers
Product
Release Notes
Third Party Advisory
https://wpvulndb.com/vulnerabilities/9615

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*

Версия до 2.0.28 (исключая)

EPSS

Процентиль: 48%

0.00248

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-g86x-2j88-7hg8