Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Information

Software Type Plugin
Software Slug ultimate-member (view on wordpress.org)
Software Status Active
Software Author ultimatemember
Software Website ultimatemember.com
Software Downloads 13,334,721
Software Active Installs 200,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 73 Vulnerabilities

Submit a Vulnerability
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
6.4
CVE-2026-8489
Jul 2, 2026
Researcher: daroo
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
8.8
CVE-2026-7761
Jun 23, 2026
Researcher: tiborisaak
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
6.4
CVE-2025-15064
Apr 3, 2026
Researcher: tiborisaak
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
8.0
CVE-2026-4248
Mar 27, 2026
Researcher: HDH
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
6.1
CVE-2026-1404
Feb 17, 2026
Researcher: Dmitrii Ignatyev
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2025-13220
Dec 20, 2025
Researcher: Muhammad Yudha - DJ
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
5.3
CVE-2025-12492
Dec 19, 2025
Researcher: Athiwat Tiprasaharn (Jitlada)
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
4.3
CVE-2025-14081
Dec 16, 2025
Researcher: Boris Bogosavac
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
6.4
CVE-2025-13217
Dec 16, 2025
Researcher: tiborisaak
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call
7.2
CVE-2025-47691
May 7, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
7.5
CVE-2026-15290
Apr 16, 2025
Researcher: Muhamad Visat
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
7.5
CVE-2025-1702
Mar 4, 2025
Researcher: mikemyers
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
5.3
CVE-2024-12276
Feb 20, 2025
Researcher: tiborisaak
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
7.5
CVE-2025-0308
Jan 17, 2025
Researcher: mikemyers
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
5.3
CVE-2025-0318
Jan 17, 2025
Researcher: mikemyers
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
4.3
CVE-2024-10528
Nov 20, 2024
Researcher: tiborisaak
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
5.3
CVE-2024-8520
Oct 3, 2024
Researcher: Jack Taylor
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-8519
Oct 3, 2024
Researcher: Jack Taylor
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
5.4
CVE-2024-2765
Apr 10, 2024
Researcher: tiborisaak
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2024-2123
Mar 8, 2024
Researcher: stealthcopter
Title Status CVE ID CVSS Researchers Date
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field Patched CVE-2026-8489 6.4 daroo July 2, 2026
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure Patched CVE-2026-7761 8.8 tiborisaak June 23, 2026
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets Patched CVE-2025-15064 6.4 tiborisaak April 3, 2026
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag Patched CVE-2026-4248 8.0 HDH March 27, 2026
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters Patched CVE-2026-1404 6.1 Dmitrii Ignatyev February 17, 2026
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Patched CVE-2025-13220 6.4 Muhammad Yudha - DJ December 20, 2025
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure Patched CVE-2025-12492 5.3 Athiwat Tiprasaharn (Jitlada) December 19, 2025
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass Patched CVE-2025-14081 4.3 Boris Bogosavac December 16, 2025
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' Patched CVE-2025-13217 6.4 tiborisaak December 16, 2025
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call Patched CVE-2025-47691 7.2 Trương Hữu Phúc (truonghuuphuc) May 7, 2025
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection Patched CVE-2026-15290 7.5 Muhamad Visat April 16, 2025
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter Patched CVE-2025-1702 7.5 mikemyers March 4, 2025
Ultimate Member <= 2.9.2 - Authenticated SQL Injection Patched CVE-2024-12276 5.3 tiborisaak February 20, 2025
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection Patched CVE-2025-0308 7.5 mikemyers January 17, 2025
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure Patched CVE-2025-0318 5.3 mikemyers January 17, 2025
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update Patched CVE-2024-10528 4.3 tiborisaak November 20, 2024
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change Patched CVE-2024-8520 5.3 Jack Taylor October 3, 2024
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-8519 6.4 Jack Taylor October 3, 2024
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2024-2765 5.4 tiborisaak April 10, 2024
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2024-2123 7.2 stealthcopter March 8, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation