Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Vulnerabilities & Security Advisories 28

All 28 CVE vulnerabilities found in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities for the WordPress plugin Ultimate Member, which handles user profiles, registration, login, member directories, and content restrictions. The collection includes various security weaknesses such as cross-site scripting, SQL injection, and authentication bypasses, covering advisories published over the recent years. Readers can track the vendor’s security advisories, understand specific weakness classes, and review the product’s vulnerability history to assess risk exposure.

Vendor: ultimatemember

CVE ID Title CVSS Severity Published
CVE-2026-93428 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass CWE-862 7.5 High 2026-10-03
CVE-2026-96270 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter CWE-79 7.2 High 2026-10-03
CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) CWE-79 6.4 Medium 2026-08-25
CVE-2026-15290 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection CWE-89 7.5 High 2026-07-10
CVE-2026-8489 Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field CWE-79 6.4 Medium 2026-07-03
CVE-2026-7761 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure CWE-862 8.8 High 2026-06-24
CVE-2025-15064 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets CWE-79 6.4 Medium 2026-04-04
CVE-2026-4248 Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag CWE-285 8.0 High 2026-03-27
CVE-2026-1404 Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters CWE-79 6.1 Medium 2026-02-18
CVE-2025-13220 Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CWE-79 6.4 Medium 2025-12-21
CVE-2025-12492 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure CWE-200 5.3 Medium 2025-12-20
CVE-2025-14081 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass CWE-863 4.3 Medium 2025-12-17
CVE-2025-13217 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' CWE-79 6.4 Medium 2025-12-17
CVE-2025-1702 Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter CWE-89 7.5 High 2025-03-05
CVE-2024-12276 Ultimate Member <= 2.9.2 - Authenticated SQL Injection CWE-89 5.3 Medium 2025-02-21
CVE-2025-0308 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection CWE-89 7.5 High 2025-01-18
CVE-2025-0318 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure CWE-200 5.3 Medium 2025-01-18
CVE-2024-10528 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update CWE-862 4.3 Medium 2024-11-21
CVE-2024-8519 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2024-10-04
CVE-2024-8520 Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change CWE-352 5.3 Medium 2024-10-04
CVE-2024-2765 Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting CWE-79 5.4 Medium 2024-05-02
CVE-2024-1071 WordPress Plugin Ultimate Member 安全漏洞 9.8 Critical 2024-03-13
CVE-2024-2123 Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting CWE-79 7.2 High 2024-03-13
CVE-2022-3383 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select CWE-94 7.2 High 2022-11-29
CVE-2022-3384 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options CWE-94 7.2 High 2022-11-29
CVE-2022-3361 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes CWE-22 4.3 Medium 2022-11-29
CVE-2022-1208 Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting CWE-79 6.4 Medium 2022-06-13
CVE-2022-1209 Ultimate Member <= 2.3.1 - Arbitrary Redirect CWE-601 4.3 Medium 2022-05-10

All 28 known CVE vulnerabilities affecting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin with full Chinese analysis, references, and POCs where available.