CVE-2024-2123
CVSS 3.1 Score 7.2 of 10 (high)
Details
Summary
CVE-2024-2123 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Ultimate Member plugin for WordPress. Versions up to and including 2.8.3 are vulnerable due to insufficient input sanitization and output escaping. This issue allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Successful exploitation of this vulnerability can lead to the theft of user data or the takeover of user accounts. It is recommended that users upgrade to the latest version of the plugin or disable it until a patch is released.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.