Description

The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.

Remediation

References

CVE-2020-36170

Related Vulnerabilities

Atlassian Confluence Missing Authorization Vulnerability (CVE-2019-15005)

PrestaShop Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-4545)

Perl Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2020-12723)

WordPress Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2009-3890)

WordPress Plugin WordPress Leads Cross-Site Scripting (1.6.2)

Severity

Medium

Classification

CVE-2020-36170 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities