Ultimate Member

12 CVEs across 4 Ultimate Member products. Browse Ultimate Member vulnerabilities, severities, and proof-of-concept exploits.

Ultimate Member products with known CVEs

ProductCVEs
Ultimate Member8
Forumwp2
Ultimate-Member1
Ultimate Member – User Profile, User Registration, Login & Membership Plugin1
Ultimate Member CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2020-37169Medium5.52026-05-13WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipula…
CVE-2025-67474Medium4.32025-12-09Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec…
CVE-2025-47691Medium5.52025-05-07Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue aff…
CVE-2024-54367Critical9.82024-12-16Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1…
CVE-2023-31216Medium4.32023-07-17Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.
CVE-2021-24306Medium5.42021-05-24The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode t…
CVE-2018-0590Medium4.32018-05-14Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profil…
CVE-2018-0589Medium4.32018-05-14Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms'…
CVE-2018-0588High7.52018-05-14Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary…
CVE-2018-0587Medium4.32018-05-14Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary ima…
CVE-2018-0586Medium4.32018-05-14Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attacke…
CVE-2018-0585Medium5.42018-05-14Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTM…