Skip to contentUltimatemember Ultimate Member vulnerabilities
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.2 - Authenticated SQL InjectionCVE-2024-122765.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.9.1 - Unauthenticated SQL InjectionCVE-2025-03087.5 High
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information ExposureCVE-2025-03185.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture UpdateCVE-2024-105284.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-85196.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status ChangeCVE-2024-85205.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site ScriptingCVE-2024-27655.4 Medium
- ultimatemember login, registration, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +5 more +7 moreThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction &...CVE-2024-1071Public exploitEPSS 89.4%9.8 Critical
- ultimate member registration, ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +2 moreUltimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-2123EPSS 26.7%7.2 High
- ultimate member member, ultimatemember ultimate member +1 moreWordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-312164.3 Medium
- ultimate member member, ultimatemember ultimate member +1 moreUltimate Member < 2.6.7 - Unauthenticated Privilege EscalationCVE-2023-3460Public exploitEPSS 72.3%9.8 Critical
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-SelectCVE-2022-33837.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_optionsCVE-2022-33847.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via ShortcodesCVE-2022-33614.3 Medium
- ultimatemember ultimate member, unspecified ultimate member plugin +1 moreUltimate Member Plugin Template class-shortcodes.php load_template pathname traversalCVE-2022-39664.3 Medium
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member <= 2.3.2 - Stored Cross-Site ScriptingCVE-2022-12086.4 Medium
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member <= 2.3.1 - Arbitrary RedirectCVE-2022-12094.3 Medium
- ultimate member – user profile, user registration, login & membership plugin, ultimatemember ultimate member – user profile, user registration, login & membership plugin, ultimate member +2 moreUltimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)CVE-2021-243065.4 Medium
- ultimatemember ultimate memberThe Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields...CVE-2020-361705.3 Medium
- ultimatemember ultimate memberAn issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka...CVE-2020-3615510.0 Critical
- ultimatemember ultimate memberAn issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka...CVE-2020-361569.9 Critical
- ultimatemember ultimate memberAn issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka...CVE-2020-3615710.0 Critical
- ultimatemember ultimate memberMultiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the...CVE-2020-68595.3 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-149455.4 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and...CVE-2019-149465.4 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-149475.4 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 2.0.4 for WordPress has XSS.CVE-2018-209656.1 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-108726.1 Medium
- ultimatemember ultimate memberThe ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.CVE-2015-93046.1 Medium
- ultimatemember ultimate memberAn issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized...CVE-2019-102714.3 Medium
- ultimatemember ultimate memberAn arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress...CVE-2019-102708.8 High
- ultimatemember ultimate memberA CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before...CVE-2019-106738.8 High
- ultimatemember ultimate memberMultiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the ...CVE-2018-178666.1 Medium
- ultimatemember ultimate memberThe Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp...CVE-2018-131366.1 Medium
- ultimate member member, ultimatemember ultimate member +1 moreCross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress...CVE-2018-05855.4 Medium
- ultimatemember ultimate membercore/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross...CVE-2018-69446.1 Medium
- ultimatemember ultimate memberCross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29...CVE-2015-83546.1 Medium