EN ES
Start free
Menu

Ultimate Member: known security problems

85 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 85 known security problems on this page. Each one has a fixed version. Updating to version 2.14.1 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.14.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.14.0
Fixed in
2.14.1
What to do
If your site has an affected version, update Ultimate Member to version 2.14.1 or newer.
Official ID
CVE-2026-107625
Report title
Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.1
Fixed in
2.14.0
What to do
If your site has an affected version, update Ultimate Member to version 2.14.0 or newer.
Official ID
CVE-2026-93428
Report title
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.13.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.1
Fixed in
2.14.0
What to do
If your site has an affected version, update Ultimate Member to version 2.14.0 or newer.
Official ID
CVE-2026-96270
Report title
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 2.13.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.1
Fixed in
2.14.0
What to do
If your site has an affected version, update Ultimate Member to version 2.14.0 or newer.
Official ID
CVE-2026-96539
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.1
Fixed in
2.14.0
What to do
If your site has an affected version, update Ultimate Member to version 2.14.0 or newer.
Official ID
CVE-2026-96451
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.1
Fixed in
2.14.0
What to do
If your site has an affected version, update Ultimate Member to version 2.14.0 or newer.
Official ID
CVE-2026-62059
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.13.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.13.0
Fixed in
2.13.1
What to do
If your site has an affected version, update Ultimate Member to version 2.13.1 or newer.
Official ID
CVE-2026-85680
Report title
Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.13.0
Fixed in
2.13.0
What to do
If your site has an affected version, update Ultimate Member to version 2.13.0 or newer.
Official ID
CVE-2026-19251
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure
First reported
Sources
This week

A stranger could take over your site as an admin (from 2.6.7 up to and including 2.12.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.6.7 up to and including 2.12.1
Fixed in
2.13.0
What to do
If your site has an affected version, update Ultimate Member to version 2.13.0 or newer.
Official ID
CVE-2026-19423
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.12.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.12.1
Fixed in
2.13.0
What to do
If your site has an affected version, update Ultimate Member to version 2.13.0 or newer.
Official ID
CVE-2026-18547
Report title
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
First reported
Sources
This week

A stranger could take over your site as an admin (before 2.12.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.12.1
Fixed in
2.12.1
What to do
If your site has an affected version, update Ultimate Member to version 2.12.1 or newer.
Official ID
CVE-2026-12251
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.11.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.4
Fixed in
2.12.0
What to do
If your site has an affected version, update Ultimate Member to version 2.12.0 or newer.
Official ID
CVE-2026-8489
Report title
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
First reported
Sources
This week

Someone with a contributor account on your site could take over your site as an admin (up to and including 2.11.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.4
Fixed in
2.12.0
What to do
If your site has an affected version, update Ultimate Member to version 2.12.0 or newer.
Official ID
CVE-2026-7761
Report title
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.11.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.0
Fixed in
2.12.0
What to do
If your site has an affected version, update Ultimate Member to version 2.12.0 or newer.
Official ID
CVE-2026-11766
Report title
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.11.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.1
Fixed in
2.11.2
What to do
If your site has an affected version, update Ultimate Member to version 2.11.2 or newer.
Official ID
CVE-2025-15064
Report title
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
First reported
Sources
This week

Someone with a contributor account on your site could take over your site as an admin (up to and including 2.11.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.2
Fixed in
2.11.3
What to do
If your site has an affected version, update Ultimate Member to version 2.11.3 or newer.
Official ID
CVE-2026-4248
Report title
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.11.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.1
Fixed in
2.11.2
What to do
If your site has an affected version, update Ultimate Member to version 2.11.2 or newer.
Official ID
CVE-2026-1404
Report title
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.11.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.0
Fixed in
2.11.1
What to do
If your site has an affected version, update Ultimate Member to version 2.11.1 or newer.
Official ID
CVE-2025-13220
Report title
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.0
Fixed in
2.11.1
What to do
If your site has an affected version, update Ultimate Member to version 2.11.1 or newer.
Official ID
CVE-2025-12492
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.11.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.0
Fixed in
2.11.1
What to do
If your site has an affected version, update Ultimate Member to version 2.11.1 or newer.
Official ID
CVE-2025-13217
Report title
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.11.0
Fixed in
2.11.1
What to do
If your site has an affected version, update Ultimate Member to version 2.11.1 or newer.
Official ID
CVE-2025-14081
Report title
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
First reported
Sources
This week

Someone who already has an admin account could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.10.3
Fixed in
2.10.4
What to do
If your site has an affected version, update Ultimate Member to version 2.10.4 or newer.
Official ID
CVE-2025-47691
Report title
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.10.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.10.1
Fixed in
2.10.2
What to do
If your site has an affected version, update Ultimate Member to version 2.10.2 or newer.
Official ID
CVE-2026-15290
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.10.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.10.0
Fixed in
2.10.1
What to do
If your site has an affected version, update Ultimate Member to version 2.10.1 or newer.
Official ID
CVE-2025-1702
Report title
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.2
Fixed in
2.10.0
What to do
If your site has an affected version, update Ultimate Member to version 2.10.0 or newer.
Official ID
CVE-2024-12276
Report title
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.1
Fixed in
2.9.2
What to do
If your site has an affected version, update Ultimate Member to version 2.9.2 or newer.
Official ID
CVE-2025-0318
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.1
Fixed in
2.9.2
What to do
If your site has an affected version, update Ultimate Member to version 2.9.2 or newer.
Official ID
CVE-2025-0308
Report title
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.9
Fixed in
2.9.0
What to do
If your site has an affected version, update Ultimate Member to version 2.9.0 or newer.
Official ID
CVE-2024-10528
Report title
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.8.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.6
Fixed in
2.8.7
What to do
If your site has an affected version, update Ultimate Member to version 2.8.7 or newer.
Official ID
CVE-2024-8520
Report title
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 2.8.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.6
Fixed in
2.8.7
What to do
If your site has an affected version, update Ultimate Member to version 2.8.7 or newer.
Official ID
CVE-2024-8519
Report title
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.4
Fixed in
2.8.5
What to do
If your site has an affected version, update Ultimate Member to version 2.8.5 or newer.
Official ID
CVE-2024-2765
Report title
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 2.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.3
Fixed in
2.8.4
What to do
If your site has an affected version, update Ultimate Member to version 2.8.4 or newer.
Official ID
CVE-2024-2123
Report title
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database (from 2.1.3 up to and including 2.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.1.3 up to and including 2.8.2
Fixed in
2.8.3
What to do
If your site has an affected version, update Ultimate Member to version 2.8.3 or newer.
Official ID
CVE-2024-1071
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.8
Fixed in
2.6.9
What to do
If your site has an affected version, update Ultimate Member to version 2.6.9 or newer.
Report title
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 2.6.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.6
Fixed in
2.6.7
What to do
If your site has an affected version, update Ultimate Member to version 2.6.7 or newer.
Official ID
CVE-2023-3460
Report title
Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.0
Fixed in
2.6.1
What to do
If your site has an affected version, update Ultimate Member to version 2.6.1 or newer.
Official ID
CVE-2023-31216
Report title
Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication
First reported
Sources
This week

Someone could use it to harm your site (from 1.0 up to and including 2.5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.0 up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update Ultimate Member to version 2.5.1 or newer.
Official ID
CVE-2022-2445
Report title
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update Ultimate Member to version 2.5.1 or newer.
Official ID
CVE-2022-3361
Report title
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 2.5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update Ultimate Member to version 2.5.1 or newer.
Official ID
CVE-2022-3384
Report title
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 2.5.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.5.0
Fixed in
2.5.1
What to do
If your site has an affected version, update Ultimate Member to version 2.5.1 or newer.
Official ID
CVE-2022-3383
Report title
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 2.4.0 up to and including 2.4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.4.0 up to and including 2.4.0
Fixed in
2.4.1
What to do
If your site has an affected version, update Ultimate Member to version 2.4.1 or newer.
Report title
Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.4.1
Fixed in
2.4.2
What to do
If your site has an affected version, update Ultimate Member to version 2.4.2 or newer.
Report title
Ultimate Member <= 2.4.1 - Username Enumeration
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.1
Fixed in
2.3.2
What to do
If your site has an affected version, update Ultimate Member to version 2.3.2 or newer.
Official ID
CVE-2022-1209
Report title
Ultimate Member <= 2.3.1 - Arbitrary Redirect
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.3.2
Fixed in
2.4.0
What to do
If your site has an affected version, update Ultimate Member to version 2.4.0 or newer.
Official ID
CVE-2022-1208
Report title
Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.1.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.20
Fixed in
2.1.20
What to do
If your site has an affected version, update Ultimate Member to version 2.1.20 or newer.
Official ID
CVE-2021-24306
Report title
Ultimate Member <= 2.1.19 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.1.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.13
Fixed in
2.1.13
What to do
If your site has an affected version, update Ultimate Member to version 2.1.13 or newer.
Official ID
CVE-2020-36170
Report title
Ultimate Member <= 2.1.12 - Cross-Site Scripting
First reported
Sources
This week

A stranger could take over your site as an admin (before 2.1.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.12
Fixed in
2.1.12
What to do
If your site has an affected version, update Ultimate Member to version 2.1.12 or newer.
Official ID
CVE-2020-36157
Report title
Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles
First reported
Sources
This week

A stranger could take over your site as an admin (before 2.1.12) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.12
Fixed in
2.1.12
What to do
If your site has an affected version, update Ultimate Member to version 2.1.12 or newer.
Official ID
CVE-2020-36155
Report title
Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta
First reported
Sources
This week

Someone could take over your site as an admin (before 2.1.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.12
Fixed in
2.1.12
What to do
If your site has an affected version, update Ultimate Member to version 2.1.12 or newer.
Official ID
CVE-2020-36156
Report title
Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.7
Fixed in
2.1.7
What to do
If your site has an affected version, update Ultimate Member to version 2.1.7 or newer.
Report title
Ultimate Member <= 2.1.6 - Open Redirect
First reported
Sources
This week

Someone could use it to harm your site (before 2.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.1.3
Fixed in
2.1.3
What to do
If your site has an affected version, update Ultimate Member to version 2.1.3 or newer.
Official ID
CVE-2020-6859
Report title
Ultimate Member <= 2.1.2 - Insecure Direct Object Reference
First reported
Sources
This week

Someone could use it to harm your site (up to and including 1.3.88)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.88
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0585
Report title
Ultimate Member <= 1.3.88 - Cross Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.3
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0587
Report title
Ultimate Member <= 2.0.3 - Unauthorized Image File Upload
First reported
Sources
This week

Someone could use it to harm your site (before 2.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.4
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0586
Report title
Ultimate Member <= 2.0.3 - Directory Traversal
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.3
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-20965
Report title
Ultimate Member <= 2.0.3 - Cross Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.53)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.53
Fixed in
2.0.54
What to do
If your site has an affected version, update Ultimate Member to version 2.0.54 or newer.
Official ID
CVE-2019-14945
Report title
Ultimate Member <= 2.0.53 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.51)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.51
Fixed in
2.0.52
What to do
If your site has an affected version, update Ultimate Member to version 2.0.52 or newer.
Official ID
CVE-2019-14947
Report title
Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.51) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.51
Fixed in
2.0.52
What to do
If your site has an affected version, update Ultimate Member to version 2.0.52 or newer.
Official ID
CVE-2019-14946
Report title
Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.39
Fixed in
2.0.40
What to do
If your site has an affected version, update Ultimate Member to version 2.0.40 or newer.
Official ID
CVE-2019-10271
Report title
Ultimate Member <= 2.0.39 - Unauthorized Profile Modification
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 2.0.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.39
Fixed in
2.0.40
What to do
If your site has an affected version, update Ultimate Member to version 2.0.40 or newer.
Official ID
CVE-2019-10270
Report title
Ultimate Member <= 2.0.39 - Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.46
Fixed in
2.0.46
What to do
If your site has an affected version, update Ultimate Member to version 2.0.46 or newer.
Report title
Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server (up to and including 2.0.45)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.45
Fixed in
2.0.46
What to do
If your site has an affected version, update Ultimate Member to version 2.0.46 or newer.
Report title
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.45)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.45
Fixed in
2.0.46
What to do
If your site has an affected version, update Ultimate Member to version 2.0.46 or newer.
Report title
Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 2.0.40)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.40
Fixed in
2.0.40
What to do
If your site has an affected version, update Ultimate Member to version 2.0.40 or newer.
Official ID
CVE-2019-10673
Report title
Ultimate Member <= 2.0.39 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.0.32)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.32
Fixed in
2.0.33
What to do
If your site has an affected version, update Ultimate Member to version 2.0.33 or newer.
Report title
Ultimate Member <= 2.0.32 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.27
Fixed in
2.0.28
What to do
If your site has an affected version, update Ultimate Member to version 2.0.28 or newer.
Official ID
CVE-2018-17866
Report title
Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.22
Fixed in
2.0.22
What to do
If your site has an affected version, update Ultimate Member to version 2.0.22 or newer.
Report title
Ultimate Member <= 2.0.21 - Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (before 2.0.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.22
Fixed in
2.0.22
What to do
If your site has an affected version, update Ultimate Member to version 2.0.22 or newer.
Report title
Ultimate Member <= 2.0.21 - Arbitrary File Upload
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.17
Fixed in
2.0.18
What to do
If your site has an affected version, update Ultimate Member to version 2.0.18 or newer.
Official ID
CVE-2018-13136
Report title
Ultimate Member <= 2.0.17 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.3
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0589
Report title
Ultimate Member <= 2.0.3 - Improper Access Control
First reported
Sources
This week

Someone could use it to harm your site (before 2.0.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.4
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0590
Report title
Ultimate Member < 2.0.4 - Insecure Direct Object Reference
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.0.39) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.39
Fixed in
2.0.40
What to do
If your site has an affected version, update Ultimate Member to version 2.0.40 or newer.
Official ID
CVE-2018-0588
Report title
Ultimate Member <= 2.0.39 - Directory Traversal
First reported
Sources
This week

Someone could use it to harm your site (before 2.0.4) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.4
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-0587
Report title
Ultimate Member < 2.0.4 - Authenticated Unrestricted File Upload
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.11
Fixed in
2.0.11
What to do
If your site has an affected version, update Ultimate Member to version 2.0.11 or newer.
Official ID
CVE-2018-10234
Report title
Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 2.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.7
Fixed in
2.0.7
What to do
If your site has an affected version, update Ultimate Member to version 2.0.7 or newer.
Official ID
CVE-2018-10233
Report title
Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.0.4
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-6943
Report title
Ultimate Member <= 2.0.3 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0
Fixed in
2.0.4
What to do
If your site has an affected version, update Ultimate Member to version 2.0.4 or newer.
Official ID
CVE-2018-6944
Report title
Ultimate Member <= 2.0 - Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 1.3.83)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.83
Fixed in
1.3.84
What to do
If your site has an affected version, update Ultimate Member to version 1.3.84 or newer.
Report title
Ultimate Member <= 1.3.83 - Shortcode Injection
First reported
Sources
This week

Someone could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.75
Fixed in
1.3.76
What to do
If your site has an affected version, update Ultimate Member to version 1.3.76 or newer.
Report title
Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset
First reported
Sources
This week

Someone could read or delete private files on your server (before 1.3.65)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.65
Fixed in
1.3.65
What to do
If your site has an affected version, update Ultimate Member to version 1.3.65 or newer.
Report title
Ultimate Member <= 1.3.64 - Local File Inclusion
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.3.40)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.40
Fixed in
1.3.40
What to do
If your site has an affected version, update Ultimate Member to version 1.3.40 or newer.
Official ID
CVE-2016-10872
Report title
Ultimate Member <= 1.3.39 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.3.29)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.3.29
Fixed in
1.3.29
What to do
If your site has an affected version, update Ultimate Member to version 1.3.29 or newer.
Official ID
CVE-2015-8354
Report title
Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.3.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.3.17
Fixed in
1.3.18
What to do
If your site has an affected version, update Ultimate Member to version 1.3.18 or newer.
Official ID
CVE-2015-9304
Report title
Ultimate Member <= 1.3.17 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 1.2.98 up to and including 1.2.997)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 1.2.98 up to and including 1.2.997
Fixed in
1.3.0
What to do
If your site has an affected version, update Ultimate Member to version 1.3.0 or newer.
Report title
Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (before 1.0.84)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.0.84
Fixed in
1.0.84
What to do
If your site has an affected version, update Ultimate Member to version 1.0.84 or newer.
Report title
Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)