UM
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
14
CVEs
0
On KEV
8.8
Max CVSS
3
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7761 | 8.8 | Jun 24 | Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure Affected: through 2.11.4 |
| CVE-2026-4248 | 8.0 | Mar 27 | Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag Affected: through 2.11.2 |
| CVE-2026-93428 | 7.5 | Oct 3 | Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass Affected: through 2.13.1 |
| CVE-2026-15290 | 7.5 | Jul 10 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection Affected: through 2.10.1 |
| CVE-2026-96270 | 7.2 | Oct 3 | Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter Affected: through 2.13.1 |
| CVE-2026-107625 New | 6.4 | Oct 28 | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field Affected: through 2.14.0 |
| CVE-2026-18547 | 6.4 | Aug 25 | Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) Affected: through 2.12.1 |
| CVE-2026-8489 | 6.4 | Jul 3 | Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field Affected: through 2.11.4 |
| CVE-2025-15064 | 6.4 | Apr 4 | Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets Affected: through 2.11.1 |
| CVE-2025-13220 | 6.4 | Dec 21 | Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Affected: through 2.11.0 |
| CVE-2025-13217 | 6.4 | Dec 17 | Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' Affected: through 2.11.0 |
| CVE-2026-1404 | 6.1 | Feb 18 | Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters Affected: through 2.11.1 |
| CVE-2025-12492 | 5.3 | Dec 20 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure Affected: through 2.11.0 |
| CVE-2025-14081 | 4.3 | Dec 17 | Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass Affected: through 2.11.0 |
Showing 14