Plugin icon

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

ultimate-member

Vulnerabilities:

33

Last Updated:

October 11, 2023

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2023-06-29
Title
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 2.6.7
CVSS
9.8 (critical)
Published
2023-05-30
Title
Ultimate Member < 2.6.1 - Form Duplication via CSRF
Fixed in
Fixed in 2.6.1
CVSS
4.3 (medium)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Subscriber+ RCE
Fixed in
Fixed in 2.5.1
CVSS
7.4 (high)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ LFI via Traversal
Fixed in
Fixed in 2.5.1
CVSS
2.7 (low)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Contributor+ LFI via Traversal
Fixed in
Fixed in 2.5.1
CVSS
4.3 (medium)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ RCE
Fixed in
Fixed in 2.5.1
CVSS
4.7 (medium)
Published
2022-06-02
Title
Ultimate Member < 2.4.0 - Subscriber+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.0
CVSS
6.4 (medium)
Published
2022-04-29
Title
Ultimate Member < 2.3.2 - Open Redirect
Fixed in
Fixed in 2.3.2
CVSS
4.3 (medium)
Published
2021-05-07
Title
Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.1.20
CVSS
4.4 (medium)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update
Fixed in
Fixed in 2.1.12
CVSS
9.9 (critical)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles
Fixed in
Fixed in 2.1.12
CVSS
10.0 (critical)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
Fixed in
Fixed in 2.1.12
CVSS
10.0 (critical)
Published
2020-08-12
Title
Ultimate Member < 2.1.7 - Unauthenticated Open Redirect
Fixed in
Fixed in 2.1.7
CVSS
4.3 (medium)
Published
2020-01-13
Title
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)
Fixed in
Fixed in 2.1.3
CVSS
4.3 (medium)
Published
2019-07-22
Title
Ultimate Member <= 2.0.53 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.54
CVSS
5.4 (medium)
Published
2019-06-24
Title
Ultimate Member < 2.0.52 - CSRF and Stored XSS issues
Fixed in
Fixed in 2.0.52
CVSS
5.9 (medium)
Published
2019-05-13
Title
Ultimate Member < 2.0.46 - Multiple Vulnerabilities
Fixed in
Fixed in 2.0.46
CVSS
7.1 (high)
Published
2019-04-01
Title
Ultimate Member < 2.0.40 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.0.40
CVSS
6.5 (medium)
Published
2018-11-22
Title
Ultimate Member < 2.0.33 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.0.33
CVSS
6.5 (medium)
Published
2018-10-06
Title
Ultimate Member < 2.0.28 - Multiple XSS
Fixed in
Fixed in 2.0.28
CVSS
4.8 (medium)
Published
2018-08-10
Title
Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.22
CVSS
8.4 (high)
Published
2018-08-08
Title
Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 2.0.22
CVSS
7.5 (high)
Published
2018-07-03
Title
Ultimate Member < 2.0.18 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.18
CVSS
8.4 (high)
Published
2018-05-10
Title
Ultimate Member < 2.0.4 - Multiple Issues
Fixed in
Fixed in 2.0.4
CVSS
7.2 (high)
Published
2018-04-23
Title
Ultimate Member < 2.0.7 - Multiple Cross-Site Request Forgery Issues
Fixed in
Fixed in 2.0.7
CVSS
8.3 (high)
Published
2018-02-14
Title
Ultimate Member <= 2.0 - Multiple XSS
Fixed in
Fixed in 2.0.4
CVSS
4.7 (medium)
Published
2016-12-06
Title
Ultimate Member < 1.3.76 - Unauthenticated Change Passwords
Fixed in
Fixed in 1.3.76
CVSS
7.5 (high)
Published
2016-07-10
Title
Ultimate Member < 1.3.65 - Local File Inclusion
Fixed in
Fixed in 1.3.65
CVSS
5.9 (medium)
Published
2016-04-06
Title
Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.40
CVSS
6.1 (medium)
Published
2015-12-02
Title
Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.29
CVSS
5.4 (medium)
Published
2015-08-20
Title
Ultimate Member < 1.3.18 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.18
CVSS
6.1 (medium)
Published
2015-06-18
Title
Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.2.995
CVSS
5.4 (medium)
Published
2015-03-16
Title
Ultimate Member <= 1.0.78 - Multiple Vulnerabilities
Fixed in
Fixed in 1.0.84
CVSS
7.5 (high)