Description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Form Unspecified Vulnerability (1.1.9)
Dotclear Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-1613)
WordPress Plugin FV Flowplayer Video Player Multiple Vulnerabilities (7.3.14.727)
Jetty CVE-2020-27218 Vulnerability (CVE-2020-27218)
Django Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-45116)