Log in Start free

ultimatemember

Products

ProductCVEsExploitedLatest
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin30–Nov 7, 2026
ForumWP – Forum & Discussion Board4–Jan 6, 2026
JobBoardWP – Job Board Listings and Submissions1–Nov 23, 2024

Exploited and recent CVEs

  • CVE-2026-116621 Medium 6.4 Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field –
  • CVE-2026-107625 Medium 6.4 Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field 0.2%
  • CVE-2026-93428 High 7.5 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass 0.5%
  • CVE-2026-96270 High 7.2 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter 0.2%
  • CVE-2026-18547 Medium 6.4 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) 0.4%
  • CVE-2026-15290 High 7.5 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection 0.5%
  • CVE-2026-8489 Medium 6.4 Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field 0.4%
  • CVE-2026-7761 High 8.8 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure 0.7%
  • CVE-2025-15064 Medium 6.4 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets 0.3%
  • CVE-2026-4248 High 8.0 Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag 0.2%
  • CVE-2026-1404 Medium 6.1 Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters 0.3%
  • CVE-2025-13746 Medium 6.4 ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name 0.2%
  • CVE-2025-13220 Medium 6.4 Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.2%
  • CVE-2025-12492 Medium 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure 0.5%
  • CVE-2025-14081 Medium 4.3 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass 0.3%
  • CVE-2025-13217 Medium 6.4 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' 0.3%
  • CVE-2025-1702 High 7.5 Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter 0.7%
  • CVE-2024-12276 Medium 5.3 Ultimate Member <= 2.9.2 - Authenticated SQL Injection 0.4%
  • CVE-2025-0308 High 7.5 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection 0.5%
  • CVE-2025-0318 Medium 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure 0.4%
  • CVE-2024-11204 Medium 6.1 ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter 0.3%
  • CVE-2024-10879 Medium 6.1 ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting 0.4%
  • CVE-2024-10880 Medium 6.1 JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting 0.5%
  • CVE-2024-10528 Medium 4.3 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update 0.6%
  • CVE-2024-8519 Medium 6.4 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-8520 Medium 5.3 Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change 0.3%
  • CVE-2024-8428 High 8.8 ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover 0.5%
  • CVE-2024-2765 Medium 5.4 Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.5%
  • CVE-2024-1071 Critical 9.8 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in ve 89.4%
  • CVE-2024-2123 High 7.2 Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting 26.7%