UM
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
14
CVEs
0
On KEV
8.8
Max CVSS
3
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-7761 | 8.8 | Jun 24 | Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure Affected: through 2.11.4 |
| CVE-2026-4248 | 8.0 | Mar 27 | Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag Affected: through 2.11.2 |
| CVE-2026-93428 | 7.5 | Oct 3 | Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass Affected: through 2.13.1 |
| CVE-2026-15290 | 7.5 | Jul 10 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection Affected: through 2.10.1 |
| CVE-2026-96270 | 7.2 | Oct 3 | Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter Affected: through 2.13.1 |
Showing 5