ultimatemember vulnerabilities

CVEs per yearBy the year they were published

1. 20225
2. 202410
3. 20258
4. 202611

Newest CVEs

• CVE-2026-107625

  Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Medium6.4
• CVE-2026-93428

  Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  High7.5
• CVE-2026-96270

  Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  High7.2
• CVE-2026-18547

  Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Medium6.4
• CVE-2026-15290

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  High7.5
• CVE-2026-8489

  Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Medium6.4
• CVE-2026-7761

  Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  High8.8
• CVE-2025-15064

  Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Medium6.4
• CVE-2026-4248

  Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  High8.0
• CVE-2026-1404

  Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Medium6.1