Stored Cross-Site Scripting Vulnerability in Ultimate Member Plugin for WordPress

CVE-2024-2765

Summary

The Ultimate Member plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the manipulation of Skype and Spotify URL parameters. This issue is present in all versions up to and including 2.8.4, stemming from inadequate input sanitization and output escaping. Authenticated users with subscriber-level access or higher can exploit this flaw to inject arbitrary scripts into web pages. When other users visit the compromised pages, their browsers will execute the injected scripts, potentially leading to session hijacking, data theft, or other malicious activities.

References