VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin security & vulnerabilities

ultimate-member— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 87 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
87Known vulnerabilities
  • Critical10
  • High22
  • Medium55
  • Low0
Vulnerabilities per year
2015: 4 vulnerabilities4152016: 3 vulnerabilities3162017: 1 vulnerability1172018: 13 vulnerabilities13182019: 13 vulnerabilities13192020: 6 vulnerabilities6202021: 1 vulnerability1212022: 8 vulnerabilities8222023: 3 vulnerabilities3232024: 6 vulnerabilities6242025: 10 vulnerabilities10252026: 19 vulnerabilities1926

All Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field
≤2.14.1Update to 2.14.2
CVE-2026-116621
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
≤2.14.0Update to 2.14.1
CVE-2026-107625
High8.1Unauthenticated PHP Object Injection
≤2.13.1Update to 2.14.0
CVE-2026-115968
High7.5Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
≤2.13.1Update to 2.14.0
CVE-2026-93428
High7.2Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
≤2.13.1Update to 2.14.0
CVE-2026-96270
High7.3Unauthenticated Privilege Escalation
≤2.13.1Update to 2.14.0
CVE-2026-96539
Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤2.13.1Update to 2.14.0
CVE-2026-96451
Medium4.9Authenticated (Administrator+) SQL Injection
≤2.13.1Update to 2.14.0
CVE-2026-62059
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.13.0Update to 2.13.1
CVE-2026-85680
Medium5.3Unauthenticated Unapproved Comment and Private Profile Data Disclosure
<2.13.0Update to 2.13.0
CVE-2026-19251
High7.32.12.1 - Unauthenticated Privilege Escalation
2.6.7 – 2.12.1Update to 2.13.0
CVE-2026-19423
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
≤2.12.1Update to 2.13.0
CVE-2026-18547
High7.3Unauthenticated Privilege Escalation
<2.12.1Update to 2.12.1
CVE-2026-12251
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
≤2.11.4Update to 2.12.0
CVE-2026-8489
High8.8Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
≤2.11.4Update to 2.12.0
CVE-2026-7761
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.11.0Update to 2.12.0
CVE-2026-11766
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
≤2.11.1Update to 2.11.2
CVE-2025-15064
High8.0Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
≤2.11.2Update to 2.11.3
CVE-2026-4248
Medium6.1Reflected Cross-Site Scripting via Filter Parameters
≤2.11.1Update to 2.11.2
CVE-2026-1404
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤2.11.0Update to 2.11.1
CVE-2025-13220
Medium5.3Unauthenticated Sensitive Information Exposure
≤2.11.0Update to 2.11.1
CVE-2025-12492
Medium4.3Authenticated (Subscriber+) Profile Privacy Setting Bypass
≤2.11.0Update to 2.11.1
CVE-2025-14081
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
≤2.11.0Update to 2.11.1
CVE-2025-13217
High7.2Authenticated (Administrator+) Arbitrary Function Call
≤2.10.3Update to 2.10.4
CVE-2025-47691
High7.5Unauthenticated Blind SQL Injection
≤2.10.1Update to 2.10.2
CVE-2026-15290
High7.5Unauthenticated SQL Injection via search Parameter
≤2.10.0Update to 2.10.1
CVE-2025-1702
Medium5.3Authenticated SQL Injection
≤2.9.2Update to 2.10.0
CVE-2024-12276
Medium5.3Information Exposure
≤2.9.1Update to 2.9.2
CVE-2025-0318
High7.5Unauthenticated SQL Injection
≤2.9.1Update to 2.9.2
CVE-2025-0308
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
≤2.8.9Update to 2.9.0
CVE-2024-10528
Medium5.3Cross-Site Request Forgery to Membership Status Change
≤2.8.6Update to 2.8.7
CVE-2024-8520
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.8.6Update to 2.8.7
CVE-2024-8519
Medium5.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.8.4Update to 2.8.5
CVE-2024-2765
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.3Update to 2.8.4
CVE-2024-2123
Critical9.82.8.2 - Unauthenticated SQL Injection
2.1.3 – 2.8.2Update to 2.8.3
CVE-2024-1071
Medium4.3Cross-Site Request Forgery
≤2.6.8Update to 2.6.9
—
Critical9.8Privilege Escalation via Arbitrary User Meta Updates
≤2.6.6Update to 2.6.7
CVE-2023-3460
Medium4.3Cross-Site Request Forgery to Form Duplication
≤2.6.0Update to 2.6.1
CVE-2023-31216
High7.2Authenticated (Admin+) Remote Code Execution via Multi-Select
≤2.5.0Update to 2.5.1
CVE-2022-3383
Medium4.3Authenticated (Contributor+) Directory Traversal via Shortcodes
≤2.5.0Update to 2.5.1
CVE-2022-3361
Medium4.7Authenticated (Admin+) Directory Traversal
1.0 – 2.5.0Update to 2.5.1
CVE-2022-2445
High7.2Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
≤2.5.0Update to 2.5.1
CVE-2022-3384
Medium5.4Subscriber+ Stored Cross-Site Scripting
2.4.0 – 2.4.0Update to 2.4.1
—
High7.5Username Enumeration
≤2.4.1Update to 2.4.2
—
Medium4.3Arbitrary Redirect
≤2.3.1Update to 2.3.2
CVE-2022-1209
Medium6.4Stored Cross-Site Scripting
≤2.3.2Update to 2.4.0
CVE-2022-1208
Medium6.1Reflected Cross-Site Scripting
<2.1.20Update to 2.1.20
CVE-2021-24306
Medium6.5Cross-Site Scripting
<2.1.13Update to 2.1.13
CVE-2020-36170
Critical10.0Unauthenticated Privilege Escalation via User Roles
<2.1.12Update to 2.1.12
CVE-2020-36157
Critical9.9Authenticated Privilege Escalation via Profile Update
<2.1.12Update to 2.1.12
CVE-2020-36156
Critical10.0Unauthenticated Privilege Escalation via User Meta
<2.1.12Update to 2.1.12
CVE-2020-36155
Medium6.1Open Redirect
<2.1.7Update to 2.1.7
—
Medium5.3Insecure Direct Object Reference
<2.1.3Update to 2.1.3
CVE-2020-6859
Medium4.3Directory Traversal
<2.0.4Update to 2.0.4
CVE-2018-0586
Medium6.1Cross Site Scripting
≤2.0.3Update to 2.0.4
CVE-2018-20965
Medium6.1Cross Site Scripting
≤1.3.88Update to 2.0.4
CVE-2018-0585
Medium4.3Unauthorized Image File Upload
≤2.0.3Update to 2.0.4
—
Medium6.4Cross-Site Scripting
≤2.0.53Update to 2.0.54
CVE-2019-14945
Medium6.1Cross-Site Request Forgery and Stored Cross-Site Scripting
≤2.0.51Update to 2.0.52
CVE-2019-14946
Medium5.4Cross-Site Request Forgery and Stored Cross-Site Scripting
≤2.0.51Update to 2.0.52
CVE-2019-14947
High8.8Privilege Escalation
≤2.0.39Update to 2.0.40
CVE-2019-10270
Medium4.3Unauthorized Profile Modification
≤2.0.39Update to 2.0.40
CVE-2019-10271
Critical9.4Arbitrary File Deletion/Read
≤2.0.45Update to 2.0.46
—
Medium6.4Low-Privileged Stored Cross-Site Scripting
≤2.0.45Update to 2.0.46
—
Medium5.5Admin+ Stored Cross-Site Scripting
<2.0.46Update to 2.0.46
—
High8.8Cross-Site Request Forgery
<2.0.40Update to 2.0.40
CVE-2019-10673
Medium6.1Cross-Site Request Forgery
≤2.0.32Update to 2.0.33
—
Medium6.1Multiple Cross-Site Scripting vulnerabilities
≤2.0.27Update to 2.0.28
CVE-2018-17866
Medium6.1Cross-Site Scripting
<2.0.22Update to 2.0.22
—
High8.8Arbitrary File Upload
<2.0.22Update to 2.0.22
—
Medium6.1Authenticated Cross-Site Scripting
≤2.0.17Update to 2.0.18
CVE-2018-13136
Medium4.3Improper Access Control
≤2.0.3Update to 2.0.4
CVE-2018-0589
Medium4.3Authenticated Unrestricted File Upload
<2.0.4Update to 2.0.4
CVE-2018-0587
Medium4.3Insecure Direct Object Reference
<2.0.4Update to 2.0.4
CVE-2018-0590
Medium4.3Directory Traversal
≤2.0.39Update to 2.0.40
CVE-2018-0588
Medium5.5Authenticated Cross-Site Scripting
<2.0.11Update to 2.0.11
CVE-2018-10234
High8.8Multiple Cross-Site Request Forgery Issues
<2.0.7Update to 2.0.7
CVE-2018-10233
Medium6.1Cross-Site Scripting
≤2.0Update to 2.0.4
CVE-2018-6944
Medium6.1Cross-Site Scripting
<2.0.4Update to 2.0.4
CVE-2018-6943
Critical9.8Shortcode Injection
≤1.3.83Update to 1.3.84
—
Critical9.8Missing Authorization to Password Reset
≤1.3.75Update to 1.3.76
—
Critical9.1Local File Inclusion
<1.3.65Update to 1.3.65
—
Medium6.1Cross-Site Scripting
<1.3.40Update to 1.3.40
CVE-2016-10872
Medium6.1Reflected Cross-Site Scripting
<1.3.29Update to 1.3.29
CVE-2015-8354
Medium6.1Cross-Site Scripting
≤1.3.17Update to 1.3.18
CVE-2015-9304
High7.11.2.997 - Reflected Cross-Site Scripting
1.2.98 – 1.2.997Update to 1.3.0
—
Critical9.8Authorization Bypass to Arbitrary File Upload/Delete
<1.0.84Update to 1.0.84
—

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: common questions

Does Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin have known vulnerabilities?

Yes. VulnCrest Radar lists 87 known vulnerabilities in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: 10 critical, 22 high, 55 medium. None are known to affect version null.

How do I check which version of Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerability?

CVE-2026-116621, published Nov 6, 2026: Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field. Severity: Medium (CVSS 6.4).

Is any Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerability listed in CISA KEV?

No. None of the known Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?