UM
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
29
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 9Medium 19Low 0
Watch
Add Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-12276 | 6.5 | Feb 21 | Ultimate Member <= 2.9.2 - Authenticated SQL Injection Affected: through 2.9.2 |
| CVE-2026-107625 New | 6.4 | Oct 28 | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field Affected: through 2.14.0 |
| CVE-2026-18547 | 6.4 | Aug 25 | Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) Affected: through 2.12.1 |
| CVE-2026-8489 | 6.4 | Jul 3 | Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field Affected: through 2.11.4 |
| CVE-2025-15064 | 6.4 | Apr 4 | Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets Affected: through 2.11.1 |
| CVE-2025-13220 | 6.4 | Dec 21 | Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Affected: through 2.11.0 |
| CVE-2025-13217 | 6.4 | Dec 17 | Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' Affected: through 2.11.0 |
| CVE-2026-1404 | 6.1 | Feb 18 | Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters Affected: through 2.11.1 |
| CVE-2024-2123 | 6.1 | Mar 13 | Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting Affected: through 2.8.3 |
| CVE-2024-8519 | 5.4 | Oct 4 | Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.8.6 |
| CVE-2024-2765 | 5.4 | May 2 | Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Affected: through 2.8.4 |
| CVE-2022-1208 | 5.4 | Jun 13 | Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting Affected: through 2.3.2 |
| CVE-2022-1209 | 5.4 | May 10 | Ultimate Member <= 2.3.1 - Arbitrary Redirect Affected: through 2.3.1 |
| CVE-2025-12492 | 5.3 | Dec 20 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure Affected: through 2.11.0 |
| CVE-2025-0318 | 5.3 | Jan 18 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure Affected: through 2.9.1 |
| CVE-2025-14081 | 4.3 | Dec 17 | Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass Affected: through 2.11.0 |
| CVE-2024-10528 | 4.3 | Nov 21 | Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update Affected: through 2.8.9 |
| CVE-2024-8520 | 4.3 | Oct 4 | Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change Affected: through 2.8.6 |
| CVE-2022-3361 | 4.3 | Nov 29 | Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes Affected: through 2.5.0 |
Showing 19