Login Request a demo
UL
Vendor
Ultimatemember
7 products with CVEs on record
69
CVEs
0
On KEV
3
New 30D
Products
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
8.8
14 CVEs0 on KEV3 new
UM
Ultimate Member
Ultimatemember
9.8
37 CVEs0 on KEV0 new
UP
User Profile & Membership
Ultimatemember
8.8
7 CVEs0 on KEV0 new
FO
Forumwp
Ultimatemember
9.8
4 CVEs0 on KEV0 new
JO
Jobboardwp
Ultimatemember
8.8
4 CVEs0 on KEV0 new
FF
ForumWP – Forum & Discussion Board
ultimatemember
8.8
2 CVEs0 on KEV0 new
UL
Ultimatemember
Ultimatemember
6.1
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-107625
New
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4–Oct 28Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
CVE-2026-93428
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
7.5
1%
Oct 3Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
CVE-2026-96270
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
7.2
0%
Oct 3Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
CVE-2026-18547
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4
0%
Aug 25Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
CVE-2026-15290
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
7.5
1%
Jul 10Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
CVE-2026-8489
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4
0%
Jul 3Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
CVE-2026-7761
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
8.8
1%
Jun 24Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
CVE-2025-15064
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4
0%
Apr 4Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
CVE-2026-4248
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
8.0
0%
Mar 27Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
CVE-2026-1404
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.1
0%
Feb 18Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
CVE-2025-13746
FF
ForumWP – Forum & Discussion Board
ultimatemember
6.4
0%
Jan 6ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
CVE-2025-13220
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4
0%
Dec 21Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVE-2025-12492
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
5.3
1%
Dec 20Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
CVE-2025-14081
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
4.3
0%
Dec 17Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
CVE-2025-13217
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
6.4
0%
Dec 17Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
CVE-2024-12276
UM
Ultimate Member
Ultimatemember
6.5
0%
Feb 21The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection…
CVE-2025-0318
UM
Ultimate Member
Ultimatemember
5.3
0%
Jan 18The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in…
CVE-2025-0308
UM
Ultimate Member
Ultimatemember
7.5
1%
Jan 18The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection…
CVE-2024-54367
FO
Forumwp
Ultimatemember
9.8
1%
Dec 16Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0
CVE-2023-23715
JO
Jobboardwp
Ultimatemember
8.8
1%
Dec 9Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This…
CVE-2024-11204
FO
Forumwp
Ultimatemember
6.1
0%
Dec 6The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due…
CVE-2024-10879
FO
Forumwp
Ultimatemember
6.1
0%
Dec 6The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate…
CVE-2024-10880
JO
Jobboardwp
Ultimatemember
6.1
0%
Nov 23The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without…
CVE-2024-10528
UM
Ultimate Member
Ultimatemember
4.3
1%
Nov 21The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile…
CVE-2024-8520
UM
Ultimate Member
Ultimatemember
4.3
0%
Oct 4The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery…
CVE-2024-8519
UM
Ultimate Member
Ultimatemember
5.4
0%
Oct 4The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-8428
FF
ForumWP – Forum & Discussion Board
ultimatemember
8.8
0%
Sep 6ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover
CVE-2024-2765
UM
Ultimate Member
Ultimatemember
5.4
1%
May 2The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2024-1071
UM
Ultimate Member
Ultimatemember
9.8
89%
Mar 13The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the…
CVE-2024-2123
UM
Ultimate Member
Ultimatemember
6.1
27%
Mar 13The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site…
CVE-2023-31216
UM
Ultimate Member
Ultimatemember
8.8
0%
Jul 17Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions
CVE-2023-3460
UM
Ultimate Member
Ultimatemember
9.8
72%
Jul 4The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create…
CVE-2022-4061
JO
Jobboardwp
Ultimatemember
7.5
1%
Dec 19The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary…
CVE-2022-3384
UM
Ultimate Member
Ultimatemember
7.2
3%
Nov 29The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts…
CVE-2022-3383
UM
Ultimate Member
Ultimatemember
7.2
3%
Nov 29The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that…
CVE-2022-3361
UM
Ultimate Member
Ultimatemember
4.3
3%
Nov 29The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template'…
CVE-2022-3966
UM
Ultimate Member
Ultimatemember
7.5
1%
Nov 13A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0
CVE-2022-1208
UM
Ultimate Member
Ultimatemember
5.4
1%
Jun 13The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input…
CVE-2022-1209
UM
Ultimate Member
Ultimatemember
5.4
1%
May 10The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes…
CVE-2021-39329
JO
Jobboardwp
Ultimatemember
4.8
1%
Oct 19The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the…
CVE-2021-24306
UM
Ultimate Member
Ultimatemember
5.4
1%
May 24The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when…
CVE-2020-36170
UM
Ultimate Member
Ultimatemember
5.3
1%
Jan 6The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms
CVE-2020-36157
UM
Ultimate Member
Ultimatemember
9.8
3%
Jan 4An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles
CVE-2020-36156
UM
Ultimate Member
Ultimatemember
8.8
2%
Jan 4An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update
CVE-2020-36155
UM
Ultimate Member
Ultimatemember
9.8
10%
Jan 4An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta
CVE-2020-6859
UM
Ultimate Member
Ultimatemember
5.3
2%
Jan 13Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to…
CVE-2019-14947
UM
Ultimate Member
Ultimatemember
5.4
1%
Aug 12The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade
CVE-2019-14946
UM
Ultimate Member
Ultimatemember
5.4
1%
Aug 12The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations
CVE-2019-14945
UM
Ultimate Member
Ultimatemember
5.4
1%
Aug 12The ultimate-member plugin before 2.0.54 for WordPress has XSS
CVE-2018-20965
UM
Ultimate Member
Ultimatemember
6.1
1%
Aug 12The ultimate-member plugin before 2.0.4 for WordPress has XSS
CVE-2016-10872
UM
Ultimate Member
Ultimatemember
6.1
1%
Aug 12The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form
CVE-2015-9304
UM
Ultimate Member
Ultimatemember
6.1
1%
Aug 12The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input
CVE-2019-10271
UM
Ultimate Member
Ultimatemember
4.3
1%
Jun 24An issue was discovered in the Ultimate Member plugin 2.39 for WordPress
CVE-2019-10270
UM
Ultimate Member
Ultimatemember
8.8
1%
Jun 21An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress
CVE-2019-10673
UM
Ultimate Member
Ultimatemember
8.8
2%
Apr 3A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract…
CVE-2018-17866
UM
Ultimate Member
Ultimatemember
6.1
2%
Oct 9Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress…
CVE-2018-13136
UM
Ultimate Member
Ultimatemember
6.1
1%
Jul 4The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen
CVE-2018-0590
UP
User Profile & Membership
Ultimatemember
4.3
1%
May 14Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified…
CVE-2018-0589
UP
User Profile & Membership
Ultimatemember
4.3
1%
May 14Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' page via…
CVE-2018-0588
UP
User Profile & Membership
Ultimatemember
7.5
3%
May 14Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via…