CVE-2018-17866

Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field.

• CWE-79

• https://serhack.me/articles/ultimate-member-xss-security-issueExploit, Third Party Advisory
• https://wordpress.org/plugins/ultimate-member/#developersProduct, Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9615
• https://serhack.me/articles/ultimate-member-xss-security-issueExploit, Third Party Advisory
• https://wordpress.org/plugins/ultimate-member/#developersProduct, Release Notes, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/9615

Published

Oct 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17859An issue was discovered in Joomla! before 3.8.13. Inadequate…
• CVE-2018-1786IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes i…5.3
• CVE-2018-17860Cloudera CDH has Insecure Permissions because ALL cannot be …7.2
• CVE-2018-17861A cross-site scripting (XSS) vulnerability in SAP J2EE Engin…6.1
• CVE-2018-17862A cross-site scripting (XSS) vulnerability in SAP J2EE Engin…6.1
• CVE-2018-17865A cross-site scripting (XSS) vulnerability in SAP J2EE Engin…6.1
• CVE-2018-17867The Port Forwarding functionality on DASAN H660GW devices al…
• CVE-2018-17868DASAN H660GW devices have Stored XSS in the Port Forwarding …
• CVE-2018-17869DASAN H660GW devices do not implement any CSRF protection me…
• CVE-2018-1787IBM Spectrum Protect 7.1 and 8.1 is affected by a password e…5.1
• CVE-2018-17870An issue was discovered in BTITeam XBTIT 2.5.4. The "returnt…
• CVE-2018-17871Verba Collaboration Compliance and Quality Management Platfo…6.5