UM
Product
Ultimate Member
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 25Low 0
Watch
Add Ultimate Member to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-1071 | 9.8 | Mar 13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the… Affected: 2.1.3 before 2.8.3 |
| CVE-2023-3460 | 9.8 | Jul 4 | Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation Affected: before 2.6.7 |
| CVE-2020-36157 | 9.8 | Jan 4 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles Affected: before 2.1.12 |
| CVE-2020-36155 | 9.8 | Jan 4 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta Affected: before 2.1.12 |
| CVE-2023-31216 | 8.8 | Jul 17 | WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 2.6.0 |
| CVE-2020-36156 | 8.8 | Jan 4 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update Affected: before 2.1.12 |
| CVE-2019-10270 | 8.8 | Jun 21 | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress Affected: before 2.0.40 |
| CVE-2019-10673 | 8.8 | Apr 3 | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract… Affected: before 2.0.40 |
| CVE-2025-0308 | 7.5 | Jan 18 | Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection Affected: before 2.9.2 |
| CVE-2022-3966 | 7.5 | Nov 13 | A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0 Affected: before 2.5.1 |
| CVE-2022-3384 | 7.2 | Nov 29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts… Affected: through 2.5.0 |
| CVE-2022-3383 | 7.2 | Nov 29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that… Affected: through 2.5.0 |
| CVE-2024-12276 | 6.5 | Feb 21 | Ultimate Member <= 2.9.2 - Authenticated SQL Injection Affected: before 2.10.0 |
| CVE-2024-2123 | 6.1 | Mar 13 | Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting Affected: before 2.8.4 |
| CVE-2018-20965 | 6.1 | Aug 12 | The ultimate-member plugin before 2.0.4 for WordPress has XSS Affected: before 2.0.4 |
| CVE-2016-10872 | 6.1 | Aug 12 | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form Affected: before 1.3.40 |
| CVE-2015-9304 | 6.1 | Aug 12 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input Affected: before 1.3.18 |
| CVE-2018-17866 | 6.1 | Oct 9 | Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress… Affected: before 2.0.28 |
| CVE-2018-13136 | 6.1 | Jul 4 | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen Affected: before 2.0.18 |
| CVE-2018-6944 | 6.1 | Feb 16 | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed… Affected: 2.0 |
| CVE-2015-8354 | 6.1 | Sep 11 | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the… Affected: through 1.3.28 |
| CVE-2024-8519 | 5.4 | Oct 4 | Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 2.8.7 |
| CVE-2024-2765 | 5.4 | May 2 | Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: before 2.8.5 |
| CVE-2022-1208 | 5.4 | Jun 13 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input… Affected: through 2.3.2 |
| CVE-2022-1209 | 5.4 | May 10 | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes… Affected: through 2.3.1 |
| CVE-2021-24306 | 5.4 | May 24 | The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when… Affected: before 2.1.20 |
| CVE-2019-14947 | 5.4 | Aug 12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade Affected: before 2.0.52 |
| CVE-2019-14946 | 5.4 | Aug 12 | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations Affected: before 2.0.52 |
| CVE-2019-14945 | 5.4 | Aug 12 | The ultimate-member plugin before 2.0.54 for WordPress has XSS Affected: before 2.0.54 |
| CVE-2018-0585 | 5.4 | May 14 | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: before 2.0.4 |
| CVE-2025-0318 | 5.3 | Jan 18 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure Affected: before 2.9.2 |
| CVE-2020-36170 | 5.3 | Jan 6 | The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms Affected: before 2.1.13 |
| CVE-2020-6859 | 5.3 | Jan 13 | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to… Affected: through 2.1.2 |
| CVE-2024-10528 | 4.3 | Nov 21 | Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update Affected: before 2.9.0 |
| CVE-2024-8520 | 4.3 | Oct 4 | Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change Affected: before 2.8.7 |
| CVE-2022-3361 | 4.3 | Nov 29 | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template'… Affected: through 2.5.0 |
| CVE-2019-10271 | 4.3 | Jun 24 | An issue was discovered in the Ultimate Member plugin 2.39 for WordPress Affected: before 2.0.40 |
Showing 37