Ultimatemember vulnerabilities
35 CVEs and advisories name Ultimatemember as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116621Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field
- CVE-2026-107625Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
- CVE-2026-93428Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
- CVE-2026-96270Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
- CVE-2026-18547Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
- CVE-2026-15290Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
- CVE-2026-8489Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
- CVE-2026-7761Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
- CVE-2025-15064Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
- CVE-2026-4248Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
- CVE-2026-1404Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
- CVE-2025-13746ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
- CVE-2025-13220Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2025-12492Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
- CVE-2025-14081Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
- CVE-2025-13217Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
- CVE-2025-1702Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
- CVE-2024-12276Ultimate Member <= 2.9.2 - Authenticated SQL Injection
- CVE-2025-0308Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
- CVE-2025-0318Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
- CVE-2024-11204ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter
- CVE-2024-10879ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting
- CVE-2024-10880JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting
- CVE-2024-10528Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
- CVE-2024-8519Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-8520Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
- CVE-2024-8428ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover
- CVE-2024-2765Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-1071The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v
- CVE-2024-2123Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting