Ultimatemember vulnerabilities

Products

• Ultimate Member 37
• User Profile \& Membership 7
• Forumwp 4
• Forumwp – Forum & Discussion Board 4
• Jobboardwp 4
• Jobboardwp – Job Board Listings And Submissions 2

Newest

• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field CVE-2026-116621 6.4 MediumNovember 7, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field CVE-2026-107625 6.4 MediumOctober 28, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass CVE-2026-93428 7.5 HighOctober 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter CVE-2026-96270 7.2 HighOctober 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) CVE-2026-18547 6.4 MediumAugust 25, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection CVE-2026-15290 7.5 HighJuly 10, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field CVE-2026-8489 6.4 MediumJuly 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CVE-2026-7761 8.8 HighJune 24, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2025-15064 6.4 MediumApril 4, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag CVE-2026-4248 8.0 HighMarch 27, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters CVE-2026-1404 6.1 MediumFebruary 18, 2026
• ultimatemember forumwp – forum & discussion board ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name CVE-2025-13746 6.4 MediumJanuary 6, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2025-13220 6.4 MediumDecember 21, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure CVE-2025-12492 5.3 MediumDecember 20, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass CVE-2025-14081 4.3 MediumDecember 17, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' CVE-2025-13217 6.4 MediumDecember 17, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter CVE-2025-1702 7.5 HighMarch 5, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.9.2 - Authenticated SQL Injection CVE-2024-12276 5.3 MediumFebruary 21, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection CVE-2025-0308 7.5 HighJanuary 18, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure CVE-2025-0318 5.3 MediumJanuary 18, 2025
• ultimate member forumwp WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability CVE-2024-54367 9.8 CriticalDecember 16, 2024
• jobboardwp – job board listings and submissions, ultimatemember jobboardwp, jobboardwp – job board listings and submissions +2 more WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability CVE-2023-23715 5.2 MediumDecember 9, 2024
• ultimatemember forumwp, forumwp – forum & discussion board +1 more ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter CVE-2024-11204 6.1 MediumDecember 6, 2024
• ultimatemember forumwp, forumwp – forum & discussion board +1 more ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting CVE-2024-10879 6.1 MediumDecember 6, 2024
• ultimatemember jobboardwp, jobboardwp – job board listings and submissions +1 more JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting CVE-2024-10880 6.1 MediumNovember 23, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update CVE-2024-10528 4.3 MediumNovember 21, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-8519 6.4 MediumOctober 4, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change CVE-2024-8520 5.3 MediumOctober 4, 2024
• forumwp, ultimatemember forumwp – forum & discussion board +1 more ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover CVE-2024-8428 8.8 HighSeptember 6, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-2765 5.4 MediumMay 2, 2024
• ultimatemember login, registration, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +5 more +7 more The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &... CVE-2024-1071 Public exploit EPSS 89.4% 9.8 CriticalMarch 13, 2024
• ultimate member registration, ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +2 more Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting CVE-2024-2123 EPSS 26.7% 7.2 HighMarch 13, 2024
• ultimate member member, ultimatemember ultimate member +1 more WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-31216 4.3 MediumJuly 17, 2023
• ultimate member member, ultimatemember ultimate member +1 more Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation CVE-2023-3460 Public exploit EPSS 72.3% 9.8 CriticalJuly 4, 2023
• ultimatemember jobboardwp JobBoardWP < 1.2.2 - Unauthenticated Arbitrary File Upload CVE-2022-4061 Public exploit 7.5 HighDecember 19, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select CVE-2022-3383 7.2 HighNovember 29, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options CVE-2022-3384 7.2 HighNovember 29, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes CVE-2022-3361 4.3 MediumNovember 29, 2022
• ultimatemember ultimate member, unspecified ultimate member plugin +1 more Ultimate Member Plugin Template class-shortcodes.php load_template pathname traversal CVE-2022-3966 4.3 MediumNovember 13, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting CVE-2022-1208 6.4 MediumJune 13, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member <= 2.3.1 - Arbitrary Redirect CVE-2022-1209 4.3 MediumMay 10, 2022
• jobboardwp JobBoardWP – Job Board Listings and Submissions <= 1.0.7 Authenticated Stored Cross-Site Scripting CVE-2021-39329 5.5 MediumOctober 19, 2021
• ultimate member – user profile, user registration, login & membership plugin, ultimatemember ultimate member – user profile, user registration, login & membership plugin, ultimate member +2 more Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS) CVE-2021-24306 5.4 MediumMay 24, 2021
• ultimatemember ultimate member The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields... CVE-2020-36170 5.3 MediumJanuary 6, 2021
• ultimatemember ultimate member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka... CVE-2020-36155 10.0 CriticalJanuary 4, 2021
• ultimatemember ultimate member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka... CVE-2020-36156 9.9 CriticalJanuary 4, 2021
• ultimatemember ultimate member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka... CVE-2020-36157 10.0 CriticalJanuary 4, 2021
• ultimatemember ultimate member Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the... CVE-2020-6859 5.3 MediumJanuary 13, 2020
• ultimatemember ultimate member The ultimate-member plugin before 2.0.54 for WordPress has XSS. CVE-2019-14945 5.4 MediumAugust 12, 2019
• ultimatemember ultimate member The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and... CVE-2019-14946 5.4 MediumAugust 12, 2019
• Show olderLoading…