Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage

ultimatemember vulnerabilities

35 published CVEs name ultimatemember among the affected products.

Atom feed of new CVEs

Newest CVEs

  • CVE-2026-116621

    Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    Medium6.4
  • CVE-2026-107625

    Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    Medium6.4
  • CVE-2026-93428

    Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    High7.5
  • CVE-2026-96270

    Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    High7.2
  • CVE-2026-18547

    Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    Medium6.4
  • CVE-2026-15290

    Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    High7.5
  • CVE-2026-8489

    Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    Medium6.4
  • CVE-2026-7761

    Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    High8.8
  • CVE-2025-15064

    Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    Medium6.4
  • CVE-2026-4248

    Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

    ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    High8.0
All 35 in the list