WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-member
Published
2025-03-04
Title
Ultimate Member < 2.10.1 - Unauthenticated SQLi
Slug
ultimate-member
Published
2025-05-07
Title
Ultimate Member <= 2.10.3 - Admin+ Arbitrary Function Call
Slug
ultimate-member
Published
2025-04-16
Title
Ultimate Member < 2.10.2 - Unauthenticated Blind SQL Injection
Slug
ultimate-member
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Slug
ultimate-member
Published
2025-12-16
Title
Ultimate Member < 2.11.1 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Slug
ultimate-member
Published
2025-12-20
Title
Ultimate Member < 2.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Slug
ultimate-member
Published
2025-12-19
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.11.1 - Unauthenticated Sensitive Information Exposure
Slug
ultimate-member
Published
2026-02-17
Title
Ultimate Member < 2.11.2 - Reflected Cross-Site Scripting via Filter Parameters
Slug
ultimate-member
Published
2026-03-27
Title
Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag
Slug
ultimate-member
Published
2026-04-03
Title
Ultimate Member < 2.11.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
Slug
ultimate-member
Published
2026-06-15
Title
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
Slug
ultimate-member
Published
2026-06-23
Title
Ultimate Member < 2.12.0 - Contributor+ Account Takeover via Password Reset Link Disclosure
Slug
ultimate-member
Published
2026-07-02
Title
Ultimate Member < 2.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
Slug
ultimate-member
Published
2026-07-14
Title
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
Slug
ultimate-member
Published
2026-08-24
Title
Ultimate Member < 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Slug
ultimate-member
Published
2026-08-26
Title
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
Slug
ultimate-member
Published
2026-08-31
Title
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
Slug
ultimate-member-widgets-for-elementor
Published
2025-11-19
Title
Ultimate Member Widgets for Elementor < 2.4 - Missing Authorization to Unauthenticated Information Exposure
Slug
ultimate-member-widgets-for-elementor
Published
2025-11-27
Title
Ultimate Member Widgets for Elementor < 2.4 - Unauthenticated Information Exposure
Slug
ultimate-multi-design-video-carousel
Published
2025-10-02
Title
Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
ultimate-noindex-nofollow-tool
Published
2024-01-23
Title
Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF
Slug
ultimate-noindex-nofollow-tool-ii
Published
2023-04-13
Title
Ultimate Noindex Nofollow Tool II < 1.3.4 - Settings Update via CSRF
Slug
ultimate-noindex-nofollow-tool-ii
Published
2024-02-03
Title
Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS
Slug
ultimate-popup-creator
Published
2025-01-06
Title
Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection
Slug
ultimate-popup-creator
Published
2025-01-06
Title
Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation