Description

The Ultimate Member plugin for WordPress is vulnerable to open redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1 granted the victim clicks on a social icon on a user's profile page.

Remediation

References

CVE-2022-1209

Related Vulnerabilities

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-35159)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Multiple Vulnerabilities (2.0.45)

Oracle Database Server Other Vulnerability (CVE-2007-3853)

WordPress Plugin MiniMax-Page Layout Builder Cross-Site Scripting (1.9.3)

WordPress Plugin Rating-Widget:Star Review System Multiple Cross-Site Scripting Vulnerabilities (1.3.1)

Severity

Medium

Classification

CVE-2022-1209 CWE-601 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities