Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities

Product

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

by ultimatemember · last CVE Oct 28, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities29 In the news0 Timeline

Severity mix

Critical 1High 9Medium 19Low 0

Severity

All severities29 Critical1 High9 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-1071	9.8	89%	Mar 13	The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the… Affected: 2.1.3 through 2.8.2
CVE-2026-7761	8.8	1%	Jun 24	Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure Affected: through 2.11.4
CVE-2026-4248	8.0	0%	Mar 27	Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag Affected: through 2.11.2
CVE-2026-93428	7.5	1%	Oct 3	Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass Affected: through 2.13.1
CVE-2026-15290	7.5	1%	Jul 10	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection Affected: through 2.10.1
CVE-2025-1702	7.5	1%	Mar 5	Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter Affected: through 2.10.0
CVE-2025-0308	7.5	1%	Jan 18	Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection Affected: through 2.9.1
CVE-2026-96270	7.2	0%	Oct 3	Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter Affected: through 2.13.1
CVE-2022-3383	7.2	3%	Nov 29	Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select Affected: through 2.5.0
CVE-2022-3384	7.2	3%	Nov 29	Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options Affected: through 2.5.0
CVE-2024-12276	6.5	0%	Feb 21	Ultimate Member <= 2.9.2 - Authenticated SQL Injection Affected: through 2.9.2
CVE-2026-107625 New	6.4	0%	Oct 28	Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field Affected: through 2.14.0
CVE-2026-18547	6.4	0%	Aug 25	Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) Affected: through 2.12.1
CVE-2026-8489	6.4	0%	Jul 3	Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field Affected: through 2.11.4
CVE-2025-15064	6.4	0%	Apr 4	Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets Affected: through 2.11.1
CVE-2025-13220	6.4	0%	Dec 21	Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Affected: through 2.11.0
CVE-2025-13217	6.4	0%	Dec 17	Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' Affected: through 2.11.0
CVE-2026-1404	6.1	0%	Feb 18	Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters Affected: through 2.11.1
CVE-2024-2123	6.1	27%	Mar 13	Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting Affected: through 2.8.3
CVE-2024-8519	5.4	0%	Oct 4	Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.8.6
CVE-2024-2765	5.4	1%	May 2	Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 2.8.4
CVE-2022-1208	5.4	1%	Jun 13	Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting Affected: through 2.3.2
CVE-2022-1209	5.4	1%	May 10	Ultimate Member <= 2.3.1 - Arbitrary Redirect Affected: through 2.3.1
CVE-2025-12492	5.3	1%	Dec 20	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure Affected: through 2.11.0
CVE-2025-0318	5.3	0%	Jan 18	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure Affected: through 2.9.1
CVE-2025-14081	4.3	0%	Dec 17	Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass Affected: through 2.11.0
CVE-2024-10528	4.3	1%	Nov 21	Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update Affected: through 2.8.9
CVE-2024-8520	4.3	0%	Oct 4	Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change Affected: through 2.8.6
CVE-2022-3361	4.3	3%	Nov 29	Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes Affected: through 2.5.0