Input validation vulnerability in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.4.0

The Ultimate Member plugin is a plugin for websites that use WordPress, a popular website-building platform. Unfortunately, versions of the plugin up to and including version 2.4.0 have a security vulnerability that attackers can exploit. If the attacker has subscriber-level permissions or higher, they can inject malicious code into the website, which will run when a user clicks on the username of a vulnerable user. This is known as “Stored Cross-Site Scripting”.