ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

• CVE-2026-116621 Medium 6.4 Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field –
• CVE-2026-107625 Medium 6.4 Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field 0.2%
• CVE-2026-93428 High 7.5 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass 0.5%
• CVE-2026-96270 High 7.2 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter 0.2%
• CVE-2026-18547 Medium 6.4 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) 0.4%
• CVE-2026-15290 High 7.5 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection 0.5%
• CVE-2026-8489 Medium 6.4 Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field 0.4%
• CVE-2026-7761 High 8.8 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure 0.7%
• CVE-2025-15064 Medium 6.4 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets 0.3%
• CVE-2026-4248 High 8.0 Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag 0.2%
• CVE-2026-1404 Medium 6.1 Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters 0.3%
• CVE-2025-13220 Medium 6.4 Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.2%
• CVE-2025-12492 Medium 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure 0.5%
• CVE-2025-14081 Medium 4.3 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass 0.3%
• CVE-2025-13217 Medium 6.4 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' 0.3%
• CVE-2025-1702 High 7.5 Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter 0.7%
• CVE-2024-12276 Medium 5.3 Ultimate Member <= 2.9.2 - Authenticated SQL Injection 0.4%
• CVE-2025-0308 High 7.5 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection 0.5%
• CVE-2025-0318 Medium 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure 0.4%
• CVE-2024-10528 Medium 4.3 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update 0.6%
• CVE-2024-8519 Medium 6.4 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
• CVE-2024-8520 Medium 5.3 Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change 0.3%
• CVE-2024-2765 Medium 5.4 Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.5%
• CVE-2024-1071 Critical 9.8 The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in ve 89.4%
• CVE-2024-2123 High 7.2 Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting 26.7%
• CVE-2022-3383 High 7.2 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select 3.1%
• CVE-2022-3384 High 7.2 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options 3.1%
• CVE-2022-3361 Medium 4.3 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes 2.6%
• CVE-2022-1208 Medium 6.4 Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting 0.9%
• CVE-2022-1209 Medium 4.3 Ultimate Member <= 2.3.1 - Arbitrary Redirect 0.7%