VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin security & vulnerabilities

ultimate-member— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 87 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
87Known vulnerabilities
  • Critical10
  • High22
  • Medium55
  • Low0
Vulnerabilities per year
2015: 4 vulnerabilities4152016: 3 vulnerabilities3162017: 1 vulnerability1172018: 13 vulnerabilities13182019: 13 vulnerabilities13192020: 6 vulnerabilities6202021: 1 vulnerability1212022: 8 vulnerabilities8222023: 3 vulnerabilities3232024: 6 vulnerabilities6242025: 10 vulnerabilities10252026: 19 vulnerabilities1926

All Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities
SeverityVulnerabilityCVEPublished
High8.1Unauthenticated PHP Object Injection
≤2.13.1Update to 2.14.0
CVE-2026-115968
High7.5Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
≤2.13.1Update to 2.14.0
CVE-2026-93428
High7.2Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
≤2.13.1Update to 2.14.0
CVE-2026-96270
High7.3Unauthenticated Privilege Escalation
≤2.13.1Update to 2.14.0
CVE-2026-96539
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.13.0Update to 2.13.1
CVE-2026-85680
High7.32.12.1 - Unauthenticated Privilege Escalation
2.6.7 – 2.12.1Update to 2.13.0
CVE-2026-19423
High7.3Unauthenticated Privilege Escalation
<2.12.1Update to 2.12.1
CVE-2026-12251
High8.8Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
≤2.11.4Update to 2.12.0
CVE-2026-7761
High8.0Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
≤2.11.2Update to 2.11.3
CVE-2026-4248
High7.2Authenticated (Administrator+) Arbitrary Function Call
≤2.10.3Update to 2.10.4
CVE-2025-47691
High7.5Unauthenticated Blind SQL Injection
≤2.10.1Update to 2.10.2
CVE-2026-15290
High7.5Unauthenticated SQL Injection via search Parameter
≤2.10.0Update to 2.10.1
CVE-2025-1702
High7.5Unauthenticated SQL Injection
≤2.9.1Update to 2.9.2
CVE-2025-0308
High7.2Unauthenticated Stored Cross-Site Scripting
≤2.8.3Update to 2.8.4
CVE-2024-2123
Critical9.82.8.2 - Unauthenticated SQL Injection
2.1.3 – 2.8.2Update to 2.8.3
CVE-2024-1071
Critical9.8Privilege Escalation via Arbitrary User Meta Updates
≤2.6.6Update to 2.6.7
CVE-2023-3460
High7.2Authenticated (Admin+) Remote Code Execution via Multi-Select
≤2.5.0Update to 2.5.1
CVE-2022-3383
High7.2Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
≤2.5.0Update to 2.5.1
CVE-2022-3384
High7.5Username Enumeration
≤2.4.1Update to 2.4.2
—
Critical10.0Unauthenticated Privilege Escalation via User Roles
<2.1.12Update to 2.1.12
CVE-2020-36157
Critical9.9Authenticated Privilege Escalation via Profile Update
<2.1.12Update to 2.1.12
CVE-2020-36156
Critical10.0Unauthenticated Privilege Escalation via User Meta
<2.1.12Update to 2.1.12
CVE-2020-36155
High8.8Privilege Escalation
≤2.0.39Update to 2.0.40
CVE-2019-10270
Critical9.4Arbitrary File Deletion/Read
≤2.0.45Update to 2.0.46
—
High8.8Cross-Site Request Forgery
<2.0.40Update to 2.0.40
CVE-2019-10673
High8.8Arbitrary File Upload
<2.0.22Update to 2.0.22
—
High8.8Multiple Cross-Site Request Forgery Issues
<2.0.7Update to 2.0.7
CVE-2018-10233
Critical9.8Shortcode Injection
≤1.3.83Update to 1.3.84
—
Critical9.8Missing Authorization to Password Reset
≤1.3.75Update to 1.3.76
—
Critical9.1Local File Inclusion
<1.3.65Update to 1.3.65
—
High7.11.2.997 - Reflected Cross-Site Scripting
1.2.98 – 1.2.997Update to 1.3.0
—
Critical9.8Authorization Bypass to Arbitrary File Upload/Delete
<1.0.84Update to 1.0.84
—

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: common questions

Does Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin have known vulnerabilities?

Yes. VulnCrest Radar lists 87 known vulnerabilities in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: 10 critical, 22 high, 55 medium. None are known to affect version null.

How do I check which version of Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerability?

CVE-2026-116621, published Nov 6, 2026: Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field. Severity: Medium (CVSS 6.4).

Is any Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerability listed in CISA KEV?

No. None of the known Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?