# cve.now: Ultimatemember

The newest entries naming Ultimatemember as an affected vendor (up to 200), of 35 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116621](https://cve.now/CVE-2026-116621.md): Ultimate Member \<= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field (CVSS 6.4)
- [CVE-2026-107625](https://cve.now/CVE-2026-107625.md): Ultimate Member \<= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user\_url' Profile Field (CVSS 6.4)
- [CVE-2026-93428](https://cve.now/CVE-2026-93428.md): Ultimate Member \<= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass (CVSS 7.5)
- [CVE-2026-96270](https://cve.now/CVE-2026-96270.md): Ultimate Member \<= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form\_id' Parameter (CVSS 7.2)
- [CVE-2026-18547](https://cve.now/CVE-2026-18547.md): Ultimate Member \<= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) (CVSS 6.4)
- [CVE-2026-15290](https://cve.now/CVE-2026-15290.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.10.1 - Unauthenticated Blind SQL Injection (CVSS 7.5)
- [CVE-2026-8489](https://cve.now/CVE-2026-8489.md): Ultimate Member \<= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field (CVSS 6.4)
- [CVE-2026-7761](https://cve.now/CVE-2026-7761.md): Ultimate Member \<= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure (CVSS 8.8)
- [CVE-2025-15064](https://cve.now/CVE-2025-15064.md): Ultimate Member \<= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets (CVSS 6.4)
- [CVE-2026-4248](https://cve.now/CVE-2026-4248.md): Ultimate Member \<= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag (CVSS 8.0)
- [CVE-2026-1404](https://cve.now/CVE-2026-1404.md): Ultimate Member \<= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters (CVSS 6.1)
- [CVE-2025-13746](https://cve.now/CVE-2025-13746.md): ForumWP – Forum & Discussion Board \<= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name (CVSS 6.4)
- [CVE-2025-13220](https://cve.now/CVE-2025-13220.md): Ultimate Member \<= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2025-12492](https://cve.now/CVE-2025-12492.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.11.0 - Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-14081](https://cve.now/CVE-2025-14081.md): Ultimate Member \<= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass (CVSS 4.3)
- [CVE-2025-13217](https://cve.now/CVE-2025-13217.md): Ultimate Member \<= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' (CVSS 6.4)
- [CVE-2025-1702](https://cve.now/CVE-2025-1702.md): Ultimate Member \<= 2.10.0 - Unauthenticated SQL Injection via search Parameter (CVSS 7.5)
- [CVE-2024-12276](https://cve.now/CVE-2024-12276.md): Ultimate Member \<= 2.9.2 - Authenticated SQL Injection (CVSS 5.3)
- [CVE-2025-0308](https://cve.now/CVE-2025-0308.md): Ultimate Member \<= 2.9.1 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-0318](https://cve.now/CVE-2025-0318.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.9.1 - Information Exposure (CVSS 5.3)
- [CVE-2024-11204](https://cve.now/CVE-2024-11204.md): ForumWP – Forum & Discussion Board \<= 2.1.2 - Reflected Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2024-10879](https://cve.now/CVE-2024-10879.md): ForumWP – Forum & Discussion Board \<= 2.1.2 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10880](https://cve.now/CVE-2024-10880.md): JobBoardWP – Job Board Listings and Submissions \<= 1.3.0 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-10528](https://cve.now/CVE-2024-10528.md): Ultimate Member \<= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update (CVSS 4.3)
- [CVE-2024-8519](https://cve.now/CVE-2024-8519.md): Ultimate Member \<= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-8520](https://cve.now/CVE-2024-8520.md): Ultimate Member \<= 2.8.6 - Cross-Site Request Forgery to Membership Status Change (CVSS 5.3)
- [CVE-2024-8428](https://cve.now/CVE-2024-8428.md): ForumWP – Forum & Discussion Board Plugin \<= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8)
- [CVE-2024-2765](https://cve.now/CVE-2024-2765.md): Ultimate Member \<= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2024-1071](https://cve.now/CVE-2024-1071.md): The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v (CVSS 9.8)
- [CVE-2024-2123](https://cve.now/CVE-2024-2123.md): Ultimate Member \<= 2.8.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2022-3383](https://cve.now/CVE-2022-3383.md): Ultimate Member – User Profile, User Registration, Login & Membership Plugin \<= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select (CVSS 7.2)
- [CVE-2022-3384](https://cve.now/CVE-2022-3384.md): Ultimate Member – User Profile, User Registration, Login & Membership Plugin \<= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um\_populate\_dropdown\_options (CVSS 7.2)
- [CVE-2022-3361](https://cve.now/CVE-2022-3361.md): Ultimate Member – User Profile, User Registration, Login & Membership Plugin \<= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes (CVSS 4.3)
- [CVE-2022-1208](https://cve.now/CVE-2022-1208.md): Ultimate Member \<= 2.3.2 - Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-1209](https://cve.now/CVE-2022-1209.md): Ultimate Member \<= 2.3.1 - Arbitrary Redirect (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ultimatemember
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.