Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Уязвимости

• CVE-2024-1071без авторизации≤ 2.8.2

  The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v

  Критич. 9.8

• CVE-2020-36157без авторизации

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.

  Критич. 9.8

• CVE-2020-36155без авторизации

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.

  Критич. 9.8

• CVE-2023-31216без авторизации · нужен клик≤ 2.6.0

  WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

  Высокий 8.8

• CVE-2018-10233без авторизации · нужен клик

  The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.

  Высокий 8.8

• CVE-2026-96451нужен вход≤ 2.13.1

  WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

  Высокий 8.8

• CVE-2020-36156нужен вход

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update

  Высокий 8.8

• CVE-2026-7761участник+≤ 2.11.4

  Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

  Высокий 8.8

• CVE-2026-4248участник+≤ 2.11.2

  Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

  Высокий 8.0

• CVE-2026-62059высокие права≤ 2.13.1

  WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

  Высокий 7.6

• CVE-2026-93428без авторизации≤ 2.13.1

  Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

  Высокий 7.5

• CVE-2026-15290без авторизации≤ 2.10.1

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection

  Высокий 7.5

• CVE-2025-1702без авторизации≤ 2.10.0

  Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter

  Высокий 7.5

• CVE-2025-0308без авторизации≤ 2.9.1

  Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection

  Высокий 7.5

• CVE-2018-0588без авторизации

  Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker

  Высокий 7.5

• CVE-2026-96270без авторизации≤ 2.13.1

  Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

  Высокий 7.2

• CVE-2022-3384админ≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dro

  Высокий 7.2

• CVE-2022-3383админ≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select

  Высокий 7.2

• CVE-2024-12276нужен вход≤ 2.9.2

  Ultimate Member <= 2.9.2 - Authenticated SQL Injection

  Средний 6.5

• CVE-2026-18547подписчик+≤ 2.12.1

  Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

  Средний 6.4

• CVE-2026-8489подписчик+≤ 2.11.4

  Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

  Средний 6.4

• CVE-2025-13217подписчик+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'

  Средний 6.4

• CVE-2025-13220участник+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  Средний 6.4

• CVE-2026-1404без авторизации · нужен клик≤ 2.11.1

  Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters

  Средний 6.1

• CVE-2024-2123без авторизации≤ 2.8.3

  Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting

  Средний 6.1

• CVE-2018-20965без авторизации · нужен клик

  The ultimate-member plugin before 2.0.4 for WordPress has XSS.

  Средний 6.1

• CVE-2016-10872без авторизации · нужен клик

  The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

  Средний 6.1

• CVE-2015-9304без авторизации · нужен клик

  The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

  Средний 6.1

• CVE-2018-17866без авторизации · нужен клик

  Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi

  Средний 6.1

• CVE-2025-47691высокие права≤ 2.10.3

  WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability

  Средний 5.5

• CVE-2024-2765подписчик+≤ 2.8.4

  Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2022-1208нужен вход≤ 2.3.2

  Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting

  Средний 5.4

• CVE-2019-14947нужен вход

  The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.

  Средний 5.4

• CVE-2019-14946нужен вход

  The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

  Средний 5.4

• CVE-2019-14945нужен вход

  The ultimate-member plugin before 2.0.54 for WordPress has XSS.

  Средний 5.4

• CVE-2018-0585нужен вход

  Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar

  Средний 5.4

• CVE-2024-8519участник+≤ 2.8.6

  Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2025-12492без авторизации≤ 2.11.0

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information

  Средний 5.3

• CVE-2025-0318без авторизации≤ 2.9.1

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure

  Средний 5.3

• CVE-2020-36170без авторизации

  The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.

  Средний 5.3

• CVE-2020-6859без авторизации

  Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W

  Средний 5.3

• CVE-2018-10234высокие права

  Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust

  Средний 4.8

• CVE-2024-8520без авторизации≤ 2.8.6

  Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change

  Средний 4.3

• CVE-2025-14081подписчик+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass

  Средний 4.3

• CVE-2024-10528подписчик+≤ 2.8.9

  Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update

  Средний 4.3

• CVE-2018-0590нужен вход

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the

  Средний 4.3

• CVE-2018-0589нужен вход

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new

  Средний 4.3

• CVE-2018-0587нужен вход

  Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u

  Средний 4.3

• CVE-2018-0586нужен вход

  Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au

  Средний 4.3

• CVE-2022-3361участник+≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes

  Средний 4.3