Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-1208

Опубликовано: 13 июн. 2022
Источник: nvd
CVSS3: 6.4
CVSS3: 5.4
CVSS2: 3.5
EPSS Низкий

Описание

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*
Версия до 2.3.2 (включая)

EPSS

Процентиль: 51%
0.00282
Низкий

6.4 Medium

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

Связанные уязвимости

github логотип

GHSA-v6w4-v9mr-x4m3

CVSS3: 5.4
github
больше 3 лет назад

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was partially fixed in version 2.3.2 then subsequently fully patched in version 2.3.3.

EPSS

Процентиль: 51%
0.00282
Низкий

6.4 Medium

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты