Plugin icon

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

ultimate-member

Vulnerabilities:

50

Last Updated:

March 26, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-03-27
Title
Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag
Fixed in
Fixed in 2.11.3
CVSS
6.8 (medium)
Published
2026-02-17
Title
Ultimate Member < 2.11.2 - Reflected Cross-Site Scripting via Filter Parameters
Fixed in
Fixed in 2.11.2
CVSS
6.1 (medium)
Published
2025-12-20
Title
Ultimate Member < 2.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
Fixed in 2.11.1
CVSS
6.4 (medium)
Published
2025-12-19
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.11.1 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 2.11.1
CVSS
5.3 (medium)
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Fixed in
Fixed in 2.11.1
CVSS
4.3 (medium)
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Fixed in
Fixed in 2.11.1
CVSS
6.4 (medium)
Published
2025-05-07
Title
Ultimate Member <= 2.10.3 - Admin+ Arbitrary Function Call
Fixed in
Fixed in 2.10.4
CVSS
6.6 (medium)
Published
2025-04-16
Title
Ultimate Member < 2.10.2 - Unauthenticated Blind SQL Injection
Fixed in
Fixed in 2.10.2
CVSS
7.5 (high)
Published
2025-03-04
Title
Ultimate Member < 2.10.1 - Unauthenticated SQLi
Fixed in
Fixed in 2.10.1
CVSS
7.5 (high)
Published
2025-02-20
Title
Ultimate Member < 2.10.0 - Authenticated SQL Injection
Fixed in
Fixed in 2.10.0
CVSS
5.3 (medium)
Published
2025-01-17
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure
Fixed in
Fixed in 2.9.2
CVSS
5.3 (medium)
Published
2025-01-17
Title
Ultimate Member < 2.9.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.9.2
CVSS
7.5 (high)
Published
2024-11-20
Title
Ultimate Member < 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
Fixed in
Fixed in 2.9.0
CVSS
4.3 (medium)
Published
2024-10-03
Title
Ultimate Member < 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.7
CVSS
6.4 (medium)
Published
2024-10-03
Title
Ultimate Member < 2.8.7 - Cross-Site Request Forgery to Membership Status Change
Fixed in
Fixed in 2.8.7
CVSS
5.3 (medium)
Published
2024-03-08
Title
Ultimate Member < 2.8.4 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 2.8.4
CVSS
7.2 (high)
Published
2024-02-23
Title
Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 2.8.3
CVSS
6.8 (medium)
Published
2023-06-29
Title
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 2.6.7
CVSS
9.8 (critical)
Published
2023-05-30
Title
Ultimate Member < 2.6.1 - Form Duplication via CSRF
Fixed in
Fixed in 2.6.1
CVSS
4.3 (medium)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Subscriber+ RCE
Fixed in
Fixed in 2.5.1
CVSS
7.4 (high)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Contributor+ LFI via Traversal
Fixed in
Fixed in 2.5.1
CVSS
4.3 (medium)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ RCE
Fixed in
Fixed in 2.5.1
CVSS
4.7 (medium)
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ LFI via Traversal
Fixed in
Fixed in 2.5.1
CVSS
2.7 (low)
Published
2022-06-02
Title
Ultimate Member < 2.4.0 - Subscriber+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.0
CVSS
6.4 (medium)
Published
2022-04-29
Title
Ultimate Member < 2.3.2 - Open Redirect
Fixed in
Fixed in 2.3.2
CVSS
4.3 (medium)
Published
2021-05-07
Title
Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.1.20
CVSS
4.4 (medium)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta
Fixed in
Fixed in 2.1.12
CVSS
10.0 (critical)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update
Fixed in
Fixed in 2.1.12
CVSS
9.9 (critical)
Published
2020-11-09
Title
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles
Fixed in
Fixed in 2.1.12
CVSS
10.0 (critical)
Published
2020-08-12
Title
Ultimate Member < 2.1.7 - Unauthenticated Open Redirect
Fixed in
Fixed in 2.1.7
CVSS
4.3 (medium)
Published
2020-01-13
Title
Ultimate Member < 2.1.3 - Insecure Direct Object Reference (IDOR)
Fixed in
Fixed in 2.1.3
CVSS
4.3 (medium)
Published
2019-07-22
Title
Ultimate Member <= 2.0.53 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.54
CVSS
5.4 (medium)
Published
2019-06-24
Title
Ultimate Member < 2.0.52 - CSRF and Stored XSS issues
Fixed in
Fixed in 2.0.52
CVSS
5.9 (medium)
Published
2019-05-13
Title
Ultimate Member < 2.0.46 - Multiple Vulnerabilities
Fixed in
Fixed in 2.0.46
CVSS
7.1 (high)
Published
2019-04-01
Title
Ultimate Member < 2.0.40 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.0.40
CVSS
6.5 (medium)
Published
2018-11-22
Title
Ultimate Member < 2.0.33 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 2.0.33
CVSS
6.5 (medium)
Published
2018-10-06
Title
Ultimate Member < 2.0.28 - Multiple XSS
Fixed in
Fixed in 2.0.28
CVSS
4.8 (medium)
Published
2018-08-10
Title
Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.22
CVSS
8.4 (high)
Published
2018-08-08
Title
Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 2.0.22
CVSS
7.5 (high)
Published
2018-07-03
Title
Ultimate Member < 2.0.18 - Authenticated Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.18
CVSS
8.4 (high)
Published
2018-05-10
Title
Ultimate Member < 2.0.4 - Multiple Issues
Fixed in
Fixed in 2.0.4
CVSS
7.2 (high)
Published
2018-04-23
Title
Ultimate Member < 2.0.7 - Multiple Cross-Site Request Forgery Issues
Fixed in
Fixed in 2.0.7
CVSS
8.3 (high)
Published
2018-02-14
Title
Ultimate Member < 2.0.4 - Multiple XSS
Fixed in
Fixed in 2.0.4
CVSS
4.7 (medium)
Published
2016-12-06
Title
Ultimate Member < 1.3.76 - Unauthenticated Change Passwords
Fixed in
Fixed in 1.3.76
CVSS
7.5 (high)
Published
2016-07-10
Title
Ultimate Member < 1.3.65 - Local File Inclusion
Fixed in
Fixed in 1.3.65
CVSS
5.9 (medium)
Published
2016-04-06
Title
Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.40
CVSS
6.1 (medium)
Published
2015-12-02
Title
Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.29
CVSS
5.4 (medium)
Published
2015-08-20
Title
Ultimate Member < 1.3.18 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.3.18
CVSS
6.1 (medium)
Published
2015-06-18
Title
Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.2.995
CVSS
5.4 (medium)
Published
2015-03-16
Title
Ultimate Member < 1.0.84 - Multiple Vulnerabilities
Fixed in
Fixed in 1.0.84
CVSS
7.5 (high)