Threats tagged 'ghsa-jwf2-x495-fhf2'

The Ultimate Member WordPress plugin up to version 2.14.1 is vulnerable to stored cross-site scripting (XSS) via the 'pm_note' parameter, which allows authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when a privileged user visits the affected profile page and interacts with the injected content. The vulnerability arises from insufficient input sanitization and output escaping, enabling attackers to exploit a DOM-based XSS vector.