CVE-2022-1208 MEDIUM

CVE-2022-1208: Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting

Vendor Ultimatemember
Product Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Weakness CWE-79 · XSS
Published June 13, 2022
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2.

Key dates

02Disclosure timeline

June 13, 2022 CVE published
April 8, 2026 Record updated