WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ultimate-member
Published
2026-04-03
Title
Ultimate Member < 2.11.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
Slug
ultimate-member
Published
2026-06-15
Title
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
Slug
ultimate-member
Published
2026-06-23
Title
Ultimate Member < 2.12.0 - Contributor+ Account Takeover via Password Reset Link Disclosure
Slug
ultimate-member
Published
2026-07-02
Title
Ultimate Member < 2.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
Slug
ultimate-member
Published
2026-07-14
Title
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
Slug
ultimate-member
Published
2026-08-24
Title
Ultimate Member < 2.13.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Slug
ultimate-member
Published
2026-08-26
Title
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
Slug
ultimate-member
Published
2026-08-31
Title
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
Slug
ultimate-member
Published
2026-09-17
Title
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
Slug
ultimate-member
Published
2026-10-01
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.14.0 - Authenticated (Subscriber+) Privilege Escalation
Slug
ultimate-member
Published
2026-10-02
Title
Ultimate Member < 2.14.0 - Unauthenticated Stored XSS via 'form_id' Parameter
Slug
ultimate-member
Published
2026-10-02
Title
Ultimate Member < 2.14.0 - Unauthenticated Privilege Escalation
Slug
ultimate-member
Published
2026-10-02
Title
Ultimate Member < 2.14.0 - Unauthenticated Sensitive Profile Field Disclosure via Member Directory
Slug
ultimate-member
Published
2026-10-01
Title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.14.0 - Authenticated (Administrator+) SQL Injection
Slug
ultimate-member
Published
2026-10-26
Title
Ultimate Member < 2.14.0 - Unauthenticated PHP Object Injection
Slug
ultimate-member
Published
2026-10-27
Title
Ultimate Member < 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
Slug
ultimate-member-widgets-for-elementor
Published
2025-11-19
Title
Ultimate Member Widgets for Elementor < 2.4 - Missing Authorization to Unauthenticated Information Exposure
Slug
ultimate-member-widgets-for-elementor
Published
2025-11-27
Title
Ultimate Member Widgets for Elementor < 2.4 - Unauthenticated Information Exposure
Slug
ultimate-multi-design-video-carousel
Published
2025-10-02
Title
Ultimate Multi Design Video Carousel <= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Slug
ultimate-multisite
Published
2026-09-30
Title
Ultimate Multisite < 2.15.1 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
Slug
ultimate-multisite
Published
2026-10-06
Title
Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
Slug
ultimate-multisite
Published
2026-10-12
Title
Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
Slug
ultimate-noindex-nofollow-tool
Published
2024-01-23
Title
Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF
Slug
ultimate-noindex-nofollow-tool-ii
Published
2023-04-13
Title
Ultimate Noindex Nofollow Tool II < 1.3.4 - Settings Update via CSRF
Slug
ultimate-noindex-nofollow-tool-ii
Published
2024-02-03
Title
Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS