Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

ultimate-member · plugin

Known security vulnerabilities for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin. Find out in seconds which version runs on your site with WP Lens.

47 known vulnerabilities

3 critical · 20 exploitable without logging in · 3 with public exploit code · latest Oct 1, 2026

Listed on wordpress.org · latest 2.14.0 · last updated Sep 29, 2026 · 200K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

CVE-2024-1071unauthenticated≤ 2.8.2
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v
Critical 9.8
CVE-2020-36157unauthenticated
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.
Critical 9.8
CVE-2020-36155unauthenticated
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.
Critical 9.8
CVE-2023-31216unauthenticated · needs a click≤ 2.6.0
WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)
High 8.8
CVE-2018-10233unauthenticated · needs a click
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.
High 8.8
CVE-2020-36156login required
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update
High 8.8
CVE-2026-7761contributor+≤ 2.11.4
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
High 8.8
CVE-2026-4248contributor+≤ 2.11.2
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
High 8.0
CVE-2026-62059high privilege≤ 2.13.1
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
High 7.6
CVE-2026-15290unauthenticated≤ 2.10.1
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
High 7.5
CVE-2025-1702unauthenticated≤ 2.10.0
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
High 7.5
CVE-2025-0308unauthenticated≤ 2.9.1
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
High 7.5
CVE-2018-0588unauthenticated
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker
High 7.5
CVE-2022-3384admin≤ 2.5.0
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dro
High 7.2
CVE-2022-3383admin≤ 2.5.0
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
High 7.2
CVE-2024-12276login required≤ 2.9.2
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
Medium 6.5
CVE-2026-18547subscriber+≤ 2.12.1
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Medium 6.4
CVE-2026-8489subscriber+≤ 2.11.4
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
Medium 6.4
CVE-2025-13217subscriber+≤ 2.11.0
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Medium 6.4
CVE-2025-13220contributor+≤ 2.11.0
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium 6.4
CVE-2026-1404unauthenticated · needs a click≤ 2.11.1
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
Medium 6.1
CVE-2024-2123unauthenticated≤ 2.8.3
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
Medium 6.1
CVE-2018-20965unauthenticated · needs a click
The ultimate-member plugin before 2.0.4 for WordPress has XSS.
Medium 6.1
CVE-2016-10872unauthenticated · needs a click
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Medium 6.1
CVE-2015-9304unauthenticated · needs a click
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Medium 6.1
CVE-2018-17866unauthenticated · needs a click
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi
Medium 6.1
CVE-2025-47691high privilege≤ 2.10.3
WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability
Medium 5.5
CVE-2024-2765subscriber+≤ 2.8.4
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium 5.4
CVE-2022-1208login required≤ 2.3.2
Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
Medium 5.4
CVE-2019-14947login required
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
Medium 5.4
CVE-2019-14946login required
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
Medium 5.4
CVE-2019-14945login required
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
Medium 5.4
CVE-2018-0585login required
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar
Medium 5.4
CVE-2024-8519contributor+≤ 2.8.6
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 5.4
CVE-2025-12492unauthenticated≤ 2.11.0
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information
Medium 5.3
CVE-2025-0318unauthenticated≤ 2.9.1
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
Medium 5.3
CVE-2020-36170unauthenticated
The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
Medium 5.3
CVE-2020-6859unauthenticated
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W
Medium 5.3
CVE-2018-10234high privilege
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust
Medium 4.8
CVE-2024-8520unauthenticated≤ 2.8.6
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
Medium 4.3
CVE-2025-14081subscriber+≤ 2.11.0
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Medium 4.3
CVE-2024-10528subscriber+≤ 2.8.9
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
Medium 4.3
CVE-2018-0590login required
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the
Medium 4.3
CVE-2018-0589login required
Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new
Medium 4.3
CVE-2018-0587login required
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u
Medium 4.3
CVE-2018-0586login required
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au
Medium 4.3
CVE-2022-3361contributor+≤ 2.5.0
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory