UM
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
29
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 9Medium 19Low 0
Watch
Add Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7761 | 8.8 | Jun 24 | Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure Affected: through 2.11.4 |
| CVE-2026-4248 | 8.0 | Mar 27 | Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag Affected: through 2.11.2 |
| CVE-2026-93428 | 7.5 | Oct 3 | Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass Affected: through 2.13.1 |
| CVE-2026-15290 | 7.5 | Jul 10 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection Affected: through 2.10.1 |
| CVE-2025-1702 | 7.5 | Mar 5 | Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter Affected: through 2.10.0 |
| CVE-2025-0308 | 7.5 | Jan 18 | Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection Affected: through 2.9.1 |
| CVE-2026-96270 | 7.2 | Oct 3 | Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter Affected: through 2.13.1 |
| CVE-2022-3383 | 7.2 | Nov 29 | Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select Affected: through 2.5.0 |
| CVE-2022-3384 | 7.2 | Nov 29 | Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options Affected: through 2.5.0 |
Showing 9