Skip to contentUltimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile FieldCVE-2026-1166216.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile FieldCVE-2026-1076256.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy BypassCVE-2026-934287.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' ParameterCVE-2026-962707.2 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)CVE-2026-185476.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL InjectionCVE-2026-152907.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile FieldCVE-2026-84896.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link DisclosureCVE-2026-77618.8 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM GadgetsCVE-2025-150646.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template TagCVE-2026-42488.0 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter ParametersCVE-2026-14046.1 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesCVE-2025-132206.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information ExposureCVE-2025-124925.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting BypassCVE-2025-140814.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'CVE-2025-132176.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.10.0 - Unauthenticated SQL Injection via search ParameterCVE-2025-17027.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.2 - Authenticated SQL InjectionCVE-2024-122765.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.1 - Unauthenticated SQL InjectionCVE-2025-03087.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information ExposureCVE-2025-03185.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture UpdateCVE-2024-105284.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-85196.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status ChangeCVE-2024-85205.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site ScriptingCVE-2024-27655.4 Medium
- ultimatemember login, registration, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +5 more +7 moreThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...CVE-2024-1071Public exploitEPSS 89.4%9.8 Critical
- ultimate member registration, ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +2 moreUltimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-2123EPSS 26.7%7.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-SelectCVE-2022-33837.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_optionsCVE-2022-33847.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via ShortcodesCVE-2022-33614.3 Medium
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member <= 2.3.2 - Stored Cross-Site ScriptingCVE-2022-12086.4 Medium
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member <= 2.3.1 - Arbitrary RedirectCVE-2022-12094.3 Medium