Skip to content
Ultimate Member vulnerabilities
Newest
-
ultimate member member
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
CVE-2026-115968
9.8 Critical
-
ultimate member member
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
CVE-2026-96539
5.6 Medium
-
ultimate member member
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
CVE-2026-96451
Public exploit
8.8 High
-
ultimate member member
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
CVE-2026-62059
Public exploit
7.6 High
-
ultimate member member, unknown ultimate member +1 more
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
CVE-2026-85680
8.8 High
-
ultimate member member, unknown ultimate member +1 more
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
CVE-2026-19251
5.3 Medium
-
ultimate member member, unknown ultimate member +1 more
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
CVE-2026-19423
8.1 High
-
ultimate member member, unknown ultimate member +1 more
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
CVE-2026-12251
8.1 High
-
ultimate member member, unknown ultimate member +1 more
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
CVE-2026-11766
8.0 High
-
ultimate member ultimate-member
WordPress Plugin ultimate-member 2.1.3 Local File Inclusion
CVE-2020-37169
6.8 Medium
-
ultimate member forumwp
WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability
CVE-2025-67474
4.3 Medium
-
ultimate member member
WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability
CVE-2025-47691
5.5 Medium
-
ultimate member forumwp
WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability
CVE-2024-54367
9.8 Critical
-
ultimate member member, ultimatemember ultimate member +1 more
WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
CVE-2023-31216
4.3 Medium
-
ultimate member member, ultimatemember ultimate member +1 more
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
CVE-2023-3460
Public exploit
EPSS 72.3%
9.8 Critical
-
ultimate member – user profile, user registration, login & membership plugin, ultimatemember ultimate member – user profile, user registration, login & membership plugin, ultimate member +2 more
Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
CVE-2021-24306
5.4 Medium
-
ultimate member member, ultimatemember user profile \& membership +1 more
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers...
CVE-2018-0590
4.3 Medium
-
ultimate member member, ultimatemember user profile \& membership +1 more
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers...
CVE-2018-0589
4.3 Medium
-
ultimate member member, ultimatemember user profile \& membership +1 more
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version...
CVE-2018-0588
7.5 High
-
ultimate member member, ultimatemember user profile \& membership +1 more
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for...
CVE-2018-0587
4.3 Medium
-
ultimate member member, ultimatemember user profile \& membership +1 more
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to...
CVE-2018-0586
4.3 Medium
-
ultimate member member, ultimatemember ultimate member +1 more
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress...
CVE-2018-0585
5.4 Medium