Ultimatemember
65 CVEs across 8 Ultimatemember products. Browse Ultimatemember vulnerabilities, severities, and proof-of-concept exploits.
Ultimatemember products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15290 | High | 7.5 | 2026-07-10 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind… |
CVE-2026-8489 | Medium | 6.4 | 2026-07-03 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-7761 | High | 8.8 | 2026-06-24 | The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This… |
CVE-2025-15064 | Medium | 6.4 | 2026-04-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2026-4248 | High | 8.0 | 2026-03-27 | The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{use… |
CVE-2026-1404 | Medium | 6.1 | 2026-02-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflec… |
CVE-2025-13746 | Medium | 6.4 | 2026-01-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and… |
CVE-2025-13220 | Medium | 6.4 | 2025-12-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-12492 | Medium | 5.3 | 2025-12-20 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensit… |
CVE-2025-14081 | Medium | 4.3 | 2025-12-17 | The Ultimate Member plugin for WordPress is vulnerable to Profile Privacy Setting Bypass in all versions up to, and including, 2.11.0. This is due to a flaw in… |
CVE-2025-13217 | Medium | 6.4 | 2025-12-17 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-… |
CVE-2025-1702 | High | 7.5 | 2025-03-05 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-b… |
CVE-2024-12276 | Medium | 5.3 | 2025-02-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second… |
CVE-2025-0318 | Medium | 5.3 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Inform… |
CVE-2025-0308 | High | 7.5 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-b… |
CVE-2024-54367 | Critical | 9.8 | 2024-12-16 | Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1… |
CVE-2023-23715 | Medium | 5.2 | 2024-12-09 | Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2024-11204 | Medium | 6.1 | 2024-12-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and… |
CVE-2024-10879 | Medium | 6.1 | 2024-12-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg… |
CVE-2024-10880 | Medium | 6.1 | 2024-11-23 | The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remo… |
CVE-2024-10528 | Medium | 4.3 | 2024-11-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauth… |
CVE-2024-8520 | Medium | 5.3 | 2024-10-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-… |
CVE-2024-8519 | Medium | 6.4 | 2024-10-04 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-8428 | High | 8.8 | 2024-09-06 | The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions u… |
CVE-2024-2765 | Medium | 5.4 | 2024-05-02 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-1071 | Critical | 9.8 | 2024-03-13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL In… |
CVE-2024-2123 | High | 7.2 | 2024-03-13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2023-31216 | Medium | 4.3 | 2023-07-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions. |
CVE-2023-3460 | Critical | 9.8 | 2023-07-04 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attac… |
CVE-2022-4061 | High | 7.5 | 2022-12-19 | The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users… |
CVE-2022-3384 | High | 7.2 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options funct… |
CVE-2022-3383 | High | 7.2 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback… |
CVE-2022-3361 | Medium | 4.3 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on th… |
CVE-2022-3966 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the f… |
CVE-2022-1208 | Medium | 6.4 | 2022-06-13 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to… |
CVE-2022-1209 | Medium | 4.3 | 2022-05-10 | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profi… |
CVE-2021-39329 | Medium | 5.5 | 2021-10-19 | The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found… |
CVE-2021-24306 | Medium | 5.4 | 2021-05-24 | The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode t… |
CVE-2020-36170 | Medium | 5.3 | 2021-01-06 | The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. |
CVE-2020-36157 | Critical | 10.0 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of… |
CVE-2020-36156 | Critical | 9.9 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-… |
CVE-2020-36155 | Critical | 10.0 | 2021-01-04 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could su… |
CVE-2020-6859 | Medium | 5.3 | 2020-01-13 | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remo… |
CVE-2019-14947 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. |
CVE-2019-14946 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. |
CVE-2019-14945 | Medium | 5.4 | 2019-08-12 | The ultimate-member plugin before 2.0.54 for WordPress has XSS. |
CVE-2018-20965 | Medium | 6.1 | 2019-08-12 | The ultimate-member plugin before 2.0.4 for WordPress has XSS. |
CVE-2016-10872 | Medium | 6.1 | 2019-08-12 | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. |
CVE-2015-9304 | Medium | 6.1 | 2019-08-12 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. |
CVE-2019-10271 | Medium | 4.3 | 2019-06-24 | An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modi… |
CVE-2019-10270 | High | 8.8 | 2019-06-21 | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation… |
CVE-2019-10673 | High | 8.8 | 2019-04-03 | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and sub… |
CVE-2018-17866 | Medium | 6.1 | 2018-10-09 | Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2… |
CVE-2018-13136 | Medium | 6.1 | 2018-07-04 | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. |
CVE-2018-0590 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profil… |
CVE-2018-0589 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms'… |
CVE-2018-0588 | High | 7.5 | 2018-05-14 | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary… |
CVE-2018-0587 | Medium | 4.3 | 2018-05-14 | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary ima… |
CVE-2018-0586 | Medium | 4.3 | 2018-05-14 | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attacke… |
CVE-2018-0585 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTM… |
CVE-2018-10234 | Medium | 4.8 | 2018-04-23 | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fiel… |
CVE-2018-10233 | High | 8.8 | 2018-04-23 | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural… |
CVE-2018-6944 | Medium | 6.1 | 2018-02-16 | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitiz… |
CVE-2018-6943 | Medium | 6.1 | 2018-02-16 | core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly saniti… |
CVE-2015-8354 | Medium | 6.1 | 2017-09-11 | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web sc… |