Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Güvenlik açıkları

• CVE-2024-1071kimlik doğrulamasız≤ 2.8.2

  The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v

  Kritik 9.8

• CVE-2020-36157kimlik doğrulamasız

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.

  Kritik 9.8

• CVE-2020-36155kimlik doğrulamasız

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.

  Kritik 9.8

• CVE-2023-31216kimlik doğrulamasız · tıklama gerekir≤ 2.6.0

  WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

  Yüksek 8.8

• CVE-2018-10233kimlik doğrulamasız · tıklama gerekir

  The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.

  Yüksek 8.8

• CVE-2020-36156giriş gerekir

  An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update

  Yüksek 8.8

• CVE-2026-7761katılımcı+≤ 2.11.4

  Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

  Yüksek 8.8

• CVE-2026-4248katılımcı+≤ 2.11.2

  Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

  Yüksek 8.0

• CVE-2026-62059yüksek yetki≤ 2.13.1

  WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

  Yüksek 7.6

• CVE-2026-15290kimlik doğrulamasız≤ 2.10.1

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection

  Yüksek 7.5

• CVE-2025-1702kimlik doğrulamasız≤ 2.10.0

  Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter

  Yüksek 7.5

• CVE-2025-0308kimlik doğrulamasız≤ 2.9.1

  Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection

  Yüksek 7.5

• CVE-2018-0588kimlik doğrulamasız

  Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker

  Yüksek 7.5

• CVE-2022-3384yönetici≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dro

  Yüksek 7.2

• CVE-2022-3383yönetici≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select

  Yüksek 7.2

• CVE-2024-12276giriş gerekir≤ 2.9.2

  Ultimate Member <= 2.9.2 - Authenticated SQL Injection

  Orta 6.5

• CVE-2026-18547abone+≤ 2.12.1

  Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

  Orta 6.4

• CVE-2026-8489abone+≤ 2.11.4

  Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

  Orta 6.4

• CVE-2025-13217abone+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'

  Orta 6.4

• CVE-2025-13220katılımcı+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  Orta 6.4

• CVE-2026-1404kimlik doğrulamasız · tıklama gerekir≤ 2.11.1

  Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters

  Orta 6.1

• CVE-2024-2123kimlik doğrulamasız≤ 2.8.3

  Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting

  Orta 6.1

• CVE-2018-20965kimlik doğrulamasız · tıklama gerekir

  The ultimate-member plugin before 2.0.4 for WordPress has XSS.

  Orta 6.1

• CVE-2016-10872kimlik doğrulamasız · tıklama gerekir

  The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

  Orta 6.1

• CVE-2015-9304kimlik doğrulamasız · tıklama gerekir

  The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

  Orta 6.1

• CVE-2018-17866kimlik doğrulamasız · tıklama gerekir

  Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi

  Orta 6.1

• CVE-2025-47691yüksek yetki≤ 2.10.3

  WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability

  Orta 5.5

• CVE-2024-2765abone+≤ 2.8.4

  Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2022-1208giriş gerekir≤ 2.3.2

  Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting

  Orta 5.4

• CVE-2019-14947giriş gerekir

  The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.

  Orta 5.4

• CVE-2019-14946giriş gerekir

  The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

  Orta 5.4

• CVE-2019-14945giriş gerekir

  The ultimate-member plugin before 2.0.54 for WordPress has XSS.

  Orta 5.4

• CVE-2018-0585giriş gerekir

  Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar

  Orta 5.4

• CVE-2024-8519katılımcı+≤ 2.8.6

  Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2025-12492kimlik doğrulamasız≤ 2.11.0

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information

  Orta 5.3

• CVE-2025-0318kimlik doğrulamasız≤ 2.9.1

  Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure

  Orta 5.3

• CVE-2020-36170kimlik doğrulamasız

  The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.

  Orta 5.3

• CVE-2020-6859kimlik doğrulamasız

  Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W

  Orta 5.3

• CVE-2018-10234yüksek yetki

  Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust

  Orta 4.8

• CVE-2024-8520kimlik doğrulamasız≤ 2.8.6

  Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change

  Orta 4.3

• CVE-2025-14081abone+≤ 2.11.0

  Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass

  Orta 4.3

• CVE-2024-10528abone+≤ 2.8.9

  Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update

  Orta 4.3

• CVE-2018-0590giriş gerekir

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the

  Orta 4.3

• CVE-2018-0589giriş gerekir

  Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new

  Orta 4.3

• CVE-2018-0587giriş gerekir

  Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u

  Orta 4.3

• CVE-2018-0586giriş gerekir

  Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au

  Orta 4.3

• CVE-2022-3361katılımcı+≤ 2.5.0

  Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes

  Orta 4.3