Stored XSS in Ultimate Member Plugin for WordPress

The Ultimate Member WordPress plugin, version 2.13.1 and earlier, is vulnerable to a Stored Cross-Site Scripting (XSS) attack. This vulnerability arises from improper input sanitization and output escaping of the 'form_id' parameter during user registration. An unauthenticated attacker can submit a registration request containing a malicious payload, which is then stored in the database within the user's metadata. The attack is triggered when a privileged administrator accesses the user management interface in the WordPress dashboard. When the administrator views the affected user record, the plugin insecurely inserts the stored payload into the DOM using the jQuery .html() function, leading to the execution of the injected script within the administrator's browser session.

Impact

Successful exploitation results in arbitrary script execution in the context of an administrator's browser. This allows attackers to perform administrative actions on behalf of the victim, such as creating new rogue accounts, changing site settings, or facilitating further exploitation of the WordPress environment. This vulnerability affects all installations using the specified versions of the Ultimate Member plugin.

Recommendation

Prioritized actions for detection and mitigation teams:

• Update the Ultimate Member plugin to a version beyond 2.13.1 to ensure input sanitization and proper output escaping are implemented.
• Implement a Web Application Firewall (WAF) rule to inspect and block registration requests containing malicious script characters or tags in the 'form_id' parameter.
• Monitor web server access logs for anomalous registration attempts targeting the plugin's registration endpoints.