Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities

Known security issues in the Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: ultimate-member
Latest version: 2.14.0
Active installs: 200,000+
Known vulnerabilities: 106 (2 without a fix)
Data updated: 2026-10-18 07:31 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

No fix available (2)

The source lists no fixed version. Consider deactivating and replacing the plugin until a fix is released.

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: No fix available
Vulnerability	Severity	CVSS	Affected versions	Published
[en] WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. CVE-2020-37169 · Source	Medium	5.5	<= 2.1.3	2026-05-13
Ultimate Member <= 2.11.3 - Missing Authorization CVE-2026-39659 · Source	Not rated	-	<= 2.11.3	2026-02-17

Fixed in version 2.14.0 (5)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.14.0
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-96451 · Source	High	8.8	< 2.14.0	2026-10-02
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection CVE-2026-62059 · Source	High	7.6	< 2.14.0	2026-10-01
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass CVE-2026-93428 · Source	High	7.5	< 2.14.0	2026-10-02
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter CVE-2026-96270 · Source	High	7.2	< 2.14.0	2026-10-02
[en] Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1. CVE-2026-96539 · Source	Medium	5.6	< 2.14.0	2026-10-09

Fixed in version 2.13.1 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.13.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-85680 · Source	Not rated	-	< 2.13.1	2026-08-31

Fixed in version 2.13.0 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.13.0
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) CVE-2026-18547 · Source	Medium	6.4	< 2.13.0	2026-08-05
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure CVE-2026-19251 · Source	Not rated	-	< 2.13.0	2026-08-28
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation CVE-2026-19423 · Source	Not rated	-	< 2.13.0	2026-08-24

Fixed in version 2.12.1 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation CVE-2026-12251 · Source	Not rated	-	< 2.12.1	2026-07-31

Fixed in version 2.12.0 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.12.0
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CVE-2026-7761 · Source	High	8.8	< 2.12.0	2026-06-23
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field CVE-2026-8489 · Source	Medium	6.4	< 2.12.0	2026-07-02
[en] The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and a CVE-2026-11766 · Source	Not rated	-	< 2.12.0	2026-07-06

Fixed in version 2.11.3 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.11.3
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag CVE-2026-4248 · Source	Not rated	-	< 2.11.3	0000-00-00

Fixed in version 2.11.2 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.11.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CVE-2025-15064 · Source	Medium	6.4	< 2.11.2	2026-04-03
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters CVE-2026-1404 · Source	Not rated	-	< 2.11.2	0000-00-00

Fixed in version 2.11.1 (4)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.11.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2025-13220 · Source	Medium	6.4	< 2.11.1	2025-12-20
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' CVE-2025-13217 · Source	Medium	6.4	< 2.11.1	2025-12-16
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure CVE-2025-12492 · Source	Medium	5.3	< 2.11.1	2025-12-19
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass CVE-2025-14081 · Source	Medium	4.3	< 2.11.1	2025-12-16

Fixed in version 2.10.4 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.10.4
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call CVE-2025-47691 · Source	Low	0.0	< 2.10.4	2025-05-07

Fixed in version 2.10.2 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.10.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection CVE-2026-15290 · Source	High	7.5	< 2.10.2	2025-04-16

Fixed in version 2.10.1 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.10.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter CVE-2025-1702 · Source	High	7.5	< 2.10.1	0000-00-00

Fixed in version 2.10.0 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.10.0
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.9.2 - Authenticated SQL Injection CVE-2024-12276 · Source	Medium	5.3	< 2.10.0	2025-02-20

Fixed in version 2.9.2 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.9.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection CVE-2025-0308 · Source	High	7.5	< 2.9.2	0000-00-00
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure CVE-2025-0318 · Source	Medium	5.3	< 2.9.2	0000-00-00

Fixed in version 2.9.0 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.9.0
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update CVE-2024-10528 · Source	Medium	4.3	< 2.9.0	2024-11-20

Fixed in version 2.8.7 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.8.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS) CVE-2024-8519 · Source	Medium	5.4	< 2.8.7	2024-10-03
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change CVE-2024-8520 · Source	Medium	4.3	< 2.8.7	2024-10-03

Fixed in version 2.8.5 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.8.5
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-2765 · Source	Medium	5.4	< 2.8.5	2024-04-10

Fixed in version 2.8.4 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.8.4
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting CVE-2024-2123 · Source	Medium	6.1	< 2.8.4	2024-03-08

Fixed in version 2.8.3 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.8.3
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection CVE-2024-1071 · Source	Critical	9.8	< 2.8.3	2024-02-23

Fixed in version 2.6.9 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.6.9
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 2.6.8 is vulnerable to Cross Site Request Forgery (CSRF) No CVE assigned · Source	Not rated	-	< 2.6.9	2023-08-09
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.6.9	2023-08-08

Fixed in version 2.6.7 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.6.7
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates CVE-2023-3460 · Source	Critical	9.8	< 2.6.7	2023-06-29
WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-31216 · Source	Medium	4.3	< 2.6.7	2023-05-30

Fixed in version 2.5.1 (4)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.5.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.5.0 - Auth. Remote Code Execution vulnerability CVE-2022-3383 · Source	High	7.2	< 2.5.1	2022-10-28
WordPress Ultimate Member plugin <= 2.5.0 - Auth. Limited Remote Code Execution vulnerability CVE-2022-3384 · Source	High	7.2	< 2.5.1	2022-10-28
WordPress Ultimate Member plugin <= 2.5.0 - Auth. Directory Traversal vulnerability CVE-2022-3361 · Source	Medium	4.3	< 2.5.1	2022-10-28
WordPress Ultimate Member plugin <= 2.5.0 - Auth. Directory Traversal vulnerability CVE-2022-2445 · Source	Low	0.0	< 2.5.1	0000-00-00

Fixed in version 2.4.2 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.4.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.4.1 - Username Enumeration No CVE assigned · Source	Not rated	-	< 2.4.2	2022-07-14

Fixed in version 2.4.1 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.4.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.4.1	2022-07-15

Fixed in version 2.4.0 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.4.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-1208 · Source	Medium	5.4	< 2.4.0	2022-03-21

Fixed in version 2.3.2 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.3.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.3.1 - Open Redirect vulnerability CVE-2022-1209 · Source	Medium	5.4	< 2.3.2	2022-04-29

Fixed in version 2.1.20 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.1.20
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.1.19 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability CVE-2021-24306 · Source	Medium	5.4	< 2.1.20	2021-05-07

Fixed in version 2.1.13 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.1.13
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.1.12 - Cross-Site Scripting CVE-2020-36170 · Source	Medium	5.3	< 2.1.13	2020-12-09

Fixed in version 2.1.12 (4)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.1.12
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Meta CVE-2020-36155 · Source	Critical	9.8	< 2.1.12	2020-11-09
Ultimate Member < 2.1.12 - Unauthenticated Privilege Escalation via User Roles CVE-2020-36157 · Source	Critical	9.8	< 2.1.12	2020-11-09
Ultimate Member < 2.1.12 - Authenticated Privilege Escalation via Profile Update CVE-2020-36156 · Source	High	8.8	< 2.1.12	2020-11-09
WordPress Ultimate Member plugin <= 2.1.11 - Unauthenticated/Authenticated Privilege Escalation No CVE assigned · Source	Not rated	-	< 2.1.12	2020-11-09

Fixed in version 2.1.7 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.1.7
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.1.6 - Open Redirect No CVE assigned · Source	Not rated	-	< 2.1.7	2020-07-23
Ultimate Member < 2.1.7 - Unauthenticated Open Redirect No CVE assigned · Source	Not rated	-	< 2.1.7	-

Fixed in version 2.1.3 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.1.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.1.2 - Insecure Direct Object Reference (IDOR) vulnerability CVE-2020-6859 · Source	Medium	5.3	< 2.1.3	2020-01-13

Fixed in version 2.0.54 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.54
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.0.53 - Cross-Site Scripting (XSS) vulnerability CVE-2019-14945 · Source	Medium	5.4	< 2.0.54	2019-07-22

Fixed in version 2.0.52 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.52
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting CVE-2019-14946 · Source	Medium	5.4	< 2.0.52	2019-06-24
Ultimate Member < 2.0.52 - CSRF and Stored XSS issues CVE-2019-14947 · Source	Medium	5.4	< 2.0.52	2019-06-24
WordPress Ultimate Member plugin <= 2.0.51 - Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities No CVE assigned · Source	Not rated	-	< 2.0.52	2019-07-13

Fixed in version 2.0.46 (5)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.46
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.0.45 - Multiple vulnerabilities No CVE assigned · Source	Not rated	-	< 2.0.46	2019-05-16
Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.46	2019-05-13
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read No CVE assigned · Source	Not rated	-	< 2.0.46	2019-05-13
Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.46	2019-05-13
Ultimate Member < 2.0.46 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 2.0.46	-

Fixed in version 2.0.40 (4)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.40
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.0.39 - Privilege Escalation CVE-2019-10270 · Source	High	8.8	< 2.0.40	2019-06-15
WordPress Ultimate Member plugin <= 2.0.39 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2019-10673 · Source	High	8.8	< 2.0.40	2019-04-01
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0588 · Source	High	7.5	< 2.0.40	2018-05-10
Ultimate Member <= 2.0.39 - Unauthorized Profile Modification CVE-2019-10271 · Source	Medium	4.3	< 2.0.40	2019-06-15

Fixed in version 2.0.33 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.33
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.0.32 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 2.0.33	2018-11-27
Ultimate Member <= 2.0.32 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.0.33	2018-11-27
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 No CVE assigned · Source	Not rated	-	< 2.0.33	-

Fixed in version 2.0.28 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.28
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 2.0.28 - Multiple XSS CVE-2018-17866 · Source	Medium	6.1	< 2.0.28	2018-10-06

Fixed in version 2.0.22 (6)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.22
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member plugin <= 2.0.21 - Authenticated Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 2.0.22	2018-08-28
WordPress Ultimate Member plugin <= 2.0.21 - Unauthenticated Arbitrary File Upload vulnerability No CVE assigned · Source	Not rated	-	< 2.0.22	2018-08-09
Ultimate Member <= 2.0.21 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.0.22	2018-08-09
Ultimate Member <= 2.0.21 - Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 2.0.22	2018-08-08
Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.0.22	-
Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload No CVE assigned · Source	Not rated	-	< 2.0.22	-

Fixed in version 2.0.18 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.18
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 2.0.18 - Authenticated Cross-Site Scripting (XSS) CVE-2018-13136 · Source	Medium	6.1	< 2.0.18	2018-07-03

Fixed in version 2.0.11 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.11
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting CVE-2018-10234 · Source	Medium	4.8	< 2.0.11	2018-04-23

Fixed in version 2.0.7 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.7
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 2.0.7 - Multiple Cross-Site Request Forgery Issues CVE-2018-10233 · Source	High	8.8	< 2.0.7	2018-04-23

Fixed in version 2.0.4 (8)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 2.0.4
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 2.0.3 - Cross Site Scripting CVE-2018-20965 · Source	Medium	6.1	< 2.0.4	2019-08-12
Ultimate Member <= 2.0 - Multiple XSS CVE-2018-6943 · Source	Medium	6.1	< 2.0.4	2018-02-14
Ultimate Member <= 2.0 - Cross-Site Scripting CVE-2018-6944 · Source	Medium	6.1	< 2.0.4	2018-02-14
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0585 · Source	Medium	5.4	< 2.0.4	2018-05-10
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0589 · Source	Medium	4.3	< 2.0.4	2018-05-10
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0590 · Source	Medium	4.3	< 2.0.4	2018-05-10
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0586 · Source	Medium	4.3	< 2.0.4	2018-05-10
Multiple vulnerabilities in WordPress plugin "Ultimate Member" CVE-2018-0587 · Source	Medium	4.3	< 2.0.4	2018-05-10

Fixed in version 1.3.84 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.84
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member <= 1.3.83 - Shortcode Injection No CVE assigned · Source	Not rated	-	< 1.3.84	2017-04-17

Fixed in version 1.3.76 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.76
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 1.3.75 - Unauthenticated Change Passwords No CVE assigned · Source	Not rated	-	< 1.3.76	2016-12-06
Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset No CVE assigned · Source	Not rated	-	< 1.3.76	2016-12-06
Ultimate Member < 1.3.76 - Unauthenticated Change Passwords No CVE assigned · Source	Not rated	-	< 1.3.76	-

Fixed in version 1.3.65 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.65
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 1.3.64 - Local File Inclusion No CVE assigned · Source	Not rated	-	< 1.3.65	2016-07-10
Ultimate Member <= 1.3.64 - Local File Inclusion No CVE assigned · Source	Not rated	-	< 1.3.65	2016-07-10
Ultimate Member < 1.3.65 - Local File Inclusion No CVE assigned · Source	Not rated	-	< 1.3.65	-

Fixed in version 1.3.40 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.40
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS) CVE-2016-10872 · Source	Medium	6.1	< 1.3.40	2016-04-06

Fixed in version 1.3.29 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.29
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 1.3.29 - Unauthenticated Reflected Cross-Site Scripting (XSS) CVE-2015-8354 · Source	Medium	6.1	< 1.3.29	2015-12-02
WordPress Ultimate Member Plugin <= 1.3.28 - Reflected Cross Site Scripting No CVE assigned · Source	Not rated	-	< 1.3.29	2015-12-02

Fixed in version 1.3.18 (1)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.3.18
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member < 1.3.18 - Cross-Site Scripting (XSS) CVE-2015-9304 · Source	Medium	6.1	< 1.3.18	2015-08-20

Fixed in version 1.2.995 (2)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.2.995
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 1.2.994 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 1.2.995	2015-06-18
Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 1.2.995	2015-06-18

Fixed in version 1.0.84 (3)

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Fixed in version 1.0.84
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ultimate Member Plugin <= 1.0.78 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 1.0.84	2015-03-16
Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete No CVE assigned · Source	Not rated	-	< 1.0.84	2015-03-10
Ultimate Member <= 1.0.78 - Multiple Vulnerabilities No CVE assigned · Source	Not rated	-	< 1.0.84	-

Affects version 1.2.994 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: Affects version 1.2.994 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	>= 1.2.98 and <= 1.2.994	-

Check every plugin on your site automatically

Install the free Webforta Security plugin for WordPress and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.