Medium
Ultimate Member <= 2.3.1 - Arbitrary Redirect
Type: advisorySources: OSV
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-1209
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 09:08 UTC · Revision 1
Source evidence
Ultimate Member <= 2.3.1 - Arbitrary Redirect
core-osv · Original sourcePublished 10 May 2022, 19:34 UTC
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.
osv:CVE-2022-1209
Complete source record
{
"id": "59d4f36d294f07aed78b5d8b8511a0cd055bafe7f3b351952fa82feb0883f103",
"url": "https://osv.dev/vulnerability/CVE-2022-1209",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ultimate Member <= 2.3.1 - Arbitrary Redirect",
"summary": "The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1.",
"evidence": "osv:CVE-2022-1209",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-1209",
"aliases": [
"CVE-2022-1209"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ultimatemember/ultimatemember",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "7cf4ec68e25a57cbeb2826a2ce12d1fdbaae8d45"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.3.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"cpe": "cpe:2.3:a:ultimatemember:ultimate_member:*:*:*:*:*:wordpress:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.3.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.3.1",
"2.3.0",
"2.2.5",
"2.2.4",
"2.2.3",
"2.2.2",
"2.2.1",
"2.2.0",
"2.1.20",
"2.1.19",
"2.1.18",
"2.1.17",
"2.1.16",
"2.1.15",
"2.1.14",
"2.1.13",
"2.1.12",
"2.1.11",
"2.1.10",
"2.1.9",
"2.1.8",
"2.1.7",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.3-rc.1",
"2.1.2",
"2.1.2-rc.1",
"2.1.1",
"2.1.0",
"2.1.0-rc.2",
"2.1.0-rc.1",
"2.0.54",
"2.0.53",
"2.0.50",
"2.0.49",
"2.0.48",
"2.0.47",
"2.0.46",
"2.0.45",
"2.0.44",
"2.0.43",
"2.0.41",
"2.0.39",
"2.0.38",
"2.0.37",
"2.0.35",
"2.0.34",
"2.0.24",
"2.0.17",
"2.0.16",
"2.0.11",
"2.0.10",
"2.0.9",
"2.0.5",
"2.0.4",
"1.3.88",
"1.3.88.6",
"1.3.88.5",
"1.3.88.4",
"v1.3.88.3",
"v1.3.88.2",
"v1.3.88.1",
"v1.3.84",
"v1.3.83",
"v1.3.82",
"v1.3.81",
"v1.3.79",
"v1.3.78",
"v1.3.76",
"v1.3.75",
"v1.3.74",
"v1.3.73",
"v1.3.72",
"v1.3.71",
"v1.3.69",
"pre-v1.3.69.25",
"pre-v1.3.69.24",
"pre-v1.3.69.23",
"pre-v1.3.69.22",
"pre-v1.3.69.21",
"pre-v1.3.69.20",
"pre-v1.3.69.19",
"pre-v1.3.69.18",
"pre-v1.3.69.17",
"pre-v1.3.69.16",
"v1.3.68",
"v1.3.67",
"v1.3.66",
"v1.3.65",
"v1.3.64",
"v1.3.63",
"v1.3.62",
"v1.3.61",
"v1.3.60",
"1.3.59",
"v1.3.56",
"v1.3.55",
"v1.3.54",
"v1.3.53",
"v1.3.52",
"v1.3.51",
"pre-v1.3.50",
"v1.3.49",
"1.3.48",
"v1.3.47",
"v1.3.45",
"v1.3.44",
"v1.3.43",
"v1.3.42",
"v1.3.41",
"v1.3.40",
"v1.3.39",
"v1.3.38",
"v1.3.37",
"v1.3.36",
"v1.3.35",
"v1.3.32",
"v1.3.30",
"v1.3.29"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1209.json"
}
}
],
"modified": "2026-10-28T02:30:34.178574782Z",
"provider": "osv",
"references": [
"https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md",
"https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1209.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1209",
"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209",
"https://github.com/ultimatemember/ultimatemember/issues/989",
"https://github.com/ultimatemember/ultimatemember/pull/990"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "Wordfence",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1209.json"
}
},
"related_cves": [
{
"value": "CVE-2022-1209",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 501338,
"published_at": "2022-05-10T19:34:42+00:00"
}