WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-member
Published
2021-05-07
Title
Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)
Slug
ultimate-member
Published
2022-04-29
Title
Ultimate Member < 2.3.2 - Open Redirect
Slug
ultimate-member
Published
2022-06-02
Title
Ultimate Member < 2.4.0 - Subscriber+ Stored Cross-Site Scripting
Slug
ultimate-member
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Subscriber+ RCE
Slug
ultimate-member
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ RCE
Slug
ultimate-member
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Contributor+ LFI via Traversal
Slug
ultimate-member
Published
2022-10-28
Title
Ultimate Member < 2.5.1 - Admin+ LFI via Traversal
Slug
ultimate-member
Published
2023-06-29
Title
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Slug
ultimate-member
Published
2023-05-30
Title
Ultimate Member < 2.6.1 - Form Duplication via CSRF
Slug
ultimate-member
Published
2024-02-23
Title
Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Slug
ultimate-member
Published
2024-03-08
Title
Ultimate Member < 2.8.4 - Unauthenticated Stored Cross-Site Scripting
Slug
ultimate-member
Published
2024-10-03
Title
Ultimate Member < 2.8.7 - Cross-Site Request Forgery to Membership Status Change
Slug
ultimate-member
Published
2024-10-03
Title
Ultimate Member < 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
ultimate-member
Published
2024-11-20
Title
Ultimate Member < 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
Slug
ultimate-member
Published
2025-01-17
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure
Slug
ultimate-member
Published
2025-01-17
Title
Ultimate Member < 2.9.2 - Unauthenticated SQL Injection
Slug
ultimate-member
Published
2025-02-20
Title
Ultimate Member < 2.10.0 - Authenticated SQL Injection
Slug
ultimate-member
Published
2025-03-04
Title
Ultimate Member < 2.10.1 - Unauthenticated SQLi
Slug
ultimate-member
Published
2025-05-07
Title
Ultimate Member <= 2.10.3 - Admin+ Arbitrary Function Call
Slug
ultimate-member
Published
2025-04-16
Title
Ultimate Member < 2.10.2 - Unauthenticated Blind SQL Injection
Slug
ultimate-member
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Slug
ultimate-member
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Slug
ultimate-member
Published
2025-12-20
Title
Ultimate Member < 2.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
ultimate-member
Published
2025-12-19
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.11.1 - Unauthenticated Sensitive Information Exposure
Slug
ultimate-member-widgets-for-elementor
Published
2025-11-19
Title
Ultimate Member Widgets for Elementor < 2.4 - Missing Authorization to Unauthenticated Information Exposure