CVE-2018-10234: XSS

Q: What is CVE-2018-10234?

CVE-2018-10234 is an Authenticated Cross site Scripting vulnerability in the User Profile & Membership plugin before version 2.0.11 for WordPress.

Q: How does CVE-2018-10234 affect the User Profile & Membership plugin?

CVE-2018-10234 allows authenticated users to execute malicious scripts through the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.

Q: What is the severity of CVE-2018-10234?

CVE-2018-10234 has a severity rating of medium with a CVSS score of 4.8.

Q: How do I fix CVE-2018-10234?

To fix CVE-2018-10234, it is recommended to update the User Profile & Membership plugin to version 2.0.11 or later.

Q: Where can I find more information about CVE-2018-10234?

You can find more information about CVE-2018-10234 on the GitHub page (https://github.com/RiieCco/write-ups/tree/master/CVE-2018-10234) and the official WordPress plugin page (https://wordpress.org/plugins/ultimate-member/#developers).

Published Apr 23, 2018

Updated

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions&section=account page.

Affected Software

1 affected component

ultimatemember User Profile \& Membership Wordpress<2.0.11

Event History

Apr 23, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is CVE-2018-10234?

CVE-2018-10234 is an Authenticated Cross site Scripting vulnerability in the User Profile & Membership plugin before version 2.0.11 for WordPress.

How does CVE-2018-10234 affect the User Profile & Membership plugin?

CVE-2018-10234 allows authenticated users to execute malicious scripts through the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options&section=account page.

What is the severity of CVE-2018-10234?