Threats tagged 'ghsa-7x8c-934p-w8g4'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.4	CVE-2026-107625The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Medium6.42026-10-28GCVE DatabaseCVE-2026-107625 The Ultimate Member WordPress plugin up to version 2.14.0 is vulnerable to stored cross-site scripting (XSS) via the 'user_url' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected profile pages. Exploitation requires a visitor to click the injected Website URL link, which is enabled by default in new installations. Report on CVE-2026-107625 Vulnerability CWE-79 #ghsa-7x8c-934p-w8g4	GCVE Database	2026-10-28

Page 1 of 1