Ultimate Member < 2.2.1 Stored XSS via Profile Field (CVE-2023-10184)

Vulnerability Overview Vulnerability Name: Ultimate Member < 2.2.1 - Authenticated (Subscriber) Stored Cross-Site Scripting via WordPress Profile Field with HTML Support (SCAR Target 14-4 #10184) Vulnerability Type: Stored Cross-Site Scripting (XSS) Vulnerability Description: In the Ultimate Member plugin, due to WordPress profile fields supporting HTML, attackers can achieve stored cross-site scripting by submitting profile fields containing malicious scripts. Scope of Impact Affected Versions: Ultimate Member < 2.2.1 Affected Features: WordPress Profile Fields Affected Users: Authenticated users at the Subscriber level Remediation Fixed Version: Ultimate Member 2.2.1 and later Remediation Measure: Update the Ultimate Member plugin to the latest version to fix this vulnerability. POC Code Additional Information Publication Date: 2023-04-18 CVE ID: CVE-2023-10184 CVSS Score: 6.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Related Vulnerabilities Vulnerability ID: 10184 Vulnerability Title: Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Vulnerability Type: Stored Cross-Site Scripting CVSS Score: 6.1 Publication Date: 2023-04-18 Vulnerability Details Vulnerability Description: In the Ultimate Member plugin, due to WordPress profile fields supporting HTML, attackers can achieve stored cross-site scripting by submitting profile fields containing malicious scripts. Vulnerability Impact: Attackers can inject malicious scripts into user profiles using this vulnerability. When other users visit these profiles, the malicious scripts are executed, potentially leading to security issues such as session hijacking and data leakage. Vulnerability Fix: Update the Ultimate Member plugin to the latest version to fix this vulnerability. Exploitation Exploitation Method: Attackers can achieve stored cross-site scripting by submitting profile fields containing malicious scripts. Exploitation Conditions: The attacker must possess authenticated user privileges at the Subscriber level. Vulnerability Verification Verification Method: Attackers can verify the existence of the vulnerability by submitting profile fields containing malicious scripts. Verification Steps: 1. Log in to a Subscriber account via the Ultimate Member plugin. 2. Edit the profile and insert the malicious script into the profile field. 3. Save the profile. 4. Visit the profile page to verify if the malicious script is executed. Vulnerability Report Reporter: Wordfence Intelligence Report Date: 2023-04-18 Report Link: https://www.wordfence.com/threat-intel/vulnerabilities/id/10184 Vulnerability Tags Tags: Ultimate Member, Stored Cross-Site Scripting, WordPress, Profile Field, HTML Support, CVE-2023-10184, CVSS 6.1, Wordfence Intelligence Vulnerability Classification Classification: Stored Cross-Site Scripting (XSS) Classification Description: Stored cross-site scripting refers to a scenario where attackers store malicious scripts on the target server. These scripts are executed when other users access the relevant pages. Vulnerability Severity Severity Level: Medium Severity Description: Attackers can inject malicious scripts into user profiles using this vulnerability. When other users visit these profiles, the malicious scripts are executed, potentially leading to security issues such as session hijacking and data leakage. Vulnerability Remediation Remediation Advice: Update the Ultimate Member plugin to the latest version to fix this vulnerability. Remediation Steps: 1. Log in to the WordPress admin backend. 2. Navigate to the Plugins management page. 3. Locate the Ultimate Member plugin. 4. Click the "Update" button to update the plugin to the latest version. Vulnerability Prevention Prevention Measures: 1. Regularly update plugins to the latest versions. 2. Restrict HTML support for user profile fields. 3. Perform strict filtering and validation on user input. Vulnerability Monitoring Monitoring Methods: 1. Use Wordfence Intelligence to monitor vulnerability dynamics. 2. Regularly check plugin versions to ensure they are up to date. 3. Perform strict filtering and validation on user input to prevent malicious script injection. Vulnerability Response Response Measures: 1. Immediately update the Ultimate Member plugin to the latest version. 2. Perform strict filtering and validation on user input to prevent malicious script injection. 3. Regularly check plugin versions to ensure they are up to date. Vulnerability Summary Summary: Versions of Ultimate Member prior to 2.2.1 contain a stored cross-site scripting vulnerability. Attackers can achieve stored cross-site scripting by submitting profile fields containing malicious scripts. It is recommended that users update the plugin to the latest version immediately to fix this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Ultimate Member < 2.2.1 Stored XSS via Profile Field (CVE-2023-10184)

More from this source