Ultimate Membership Pro Vulnerable to Reflected XSS

CVE-2024-43241

Summary

A reflected Cross-site Scripting (XSS) vulnerability has been identified in the Ultimate Membership Pro plugin by Azzaroco, impacting all versions up to 12.6. This vulnerability arises from improper neutralization of user input during the web page generation process. Attackers can exploit this flaw to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized actions being taken on behalf of the user, data theft, or compromised sessions. It is essential for users of the Ultimate Membership Pro plugin to evaluate their exposure to this vulnerability and implement necessary mitigations.

References