Login Request a demo
UM
Product
Ultimate Member
by Ultimatemember · last CVE Feb 21, 2025
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities37In the news0Timeline
Severity mix
Critical 4High 8Medium 25Low 0
Severity
All severities37Critical4High8Medium25Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ultimate Member to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-31216
8.8
0%
Jul 17
WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
Affected: through 2.6.0
CVE-2020-36156
8.8
2%
Jan 4
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update
Affected: before 2.1.12
CVE-2019-10270
8.8
1%
Jun 21
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress
Affected: before 2.0.40
CVE-2019-10673
8.8
2%
Apr 3
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract…
Affected: before 2.0.40
CVE-2025-0308
7.5
1%
Jan 18
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
Affected: before 2.9.2
CVE-2022-3966
7.5
1%
Nov 13
Ultimate Member Plugin Template class-shortcodes.php load_template pathname traversal
Affected: before 2.5.1
CVE-2022-3383
7.2
3%
Nov 29
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
Affected: through 2.5.0
CVE-2022-3384
7.2
3%
Nov 29
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
Affected: through 2.5.0
Showing 8