Ultimatemember Login vulnerabilities

• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field CVE-2026-116621 6.4 MediumNovember 7, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field CVE-2026-107625 6.4 MediumOctober 28, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass CVE-2026-93428 7.5 HighOctober 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter CVE-2026-96270 7.2 HighOctober 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) CVE-2026-18547 6.4 MediumAugust 25, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection CVE-2026-15290 7.5 HighJuly 10, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field CVE-2026-8489 6.4 MediumJuly 3, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CVE-2026-7761 8.8 HighJune 24, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2025-15064 6.4 MediumApril 4, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag CVE-2026-4248 8.0 HighMarch 27, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters CVE-2026-1404 6.1 MediumFebruary 18, 2026
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2025-13220 6.4 MediumDecember 21, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure CVE-2025-12492 5.3 MediumDecember 20, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass CVE-2025-14081 4.3 MediumDecember 17, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' CVE-2025-13217 6.4 MediumDecember 17, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter CVE-2025-1702 7.5 HighMarch 5, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.9.2 - Authenticated SQL Injection CVE-2024-12276 5.3 MediumFebruary 21, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection CVE-2025-0308 7.5 HighJanuary 18, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure CVE-2025-0318 5.3 MediumJanuary 18, 2025
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update CVE-2024-10528 4.3 MediumNovember 21, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-8519 6.4 MediumOctober 4, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change CVE-2024-8520 5.3 MediumOctober 4, 2024
• ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 more Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-2765 5.4 MediumMay 2, 2024
• ultimatemember login, registration, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +5 more +7 more The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &... CVE-2024-1071 Public exploit EPSS 89.4% 9.8 CriticalMarch 13, 2024
• ultimate member registration, ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +2 more Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting CVE-2024-2123 EPSS 26.7% 7.2 HighMarch 13, 2024
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select CVE-2022-3383 7.2 HighNovember 29, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options CVE-2022-3384 7.2 HighNovember 29, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes CVE-2022-3361 4.3 MediumNovember 29, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting CVE-2022-1208 6.4 MediumJune 13, 2022
• ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 more Ultimate Member <= 2.3.1 - Arbitrary Redirect CVE-2022-1209 4.3 MediumMay 10, 2022
• ultimate member – user profile, user registration, login & membership plugin, ultimatemember ultimate member – user profile, user registration, login & membership plugin, ultimate member +2 more Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS) CVE-2021-24306 5.4 MediumMay 24, 2021