Is Ultimate Member safe?

Every recorded flaw

• Oct 28, 2026Ultimate Member: Deserialization of Untrusted DataCVE-2026-115968 · affects up to 2.13.1 · reported by PatchstackCritical 9.8
• Oct 27, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-107625 · affects up to 2.14.0 · reported by WordfenceMedium 6.4
• Oct 9, 2026Ultimate Member: Incorrect Privilege AssignmentCVE-2026-96539 · affects up to 2.13.1 · reported by PatchstackMedium 5.6
• Oct 3, 2026Ultimate Member: Authorization Bypass Through User-Controlled KeyCVE-2026-96451 · affects up to 2.13.1 · reported by PatchstackHigh 8.8
• Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-96270 · affects up to 2.13.1 · reported by WordfenceHigh 7.2
• Oct 2, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Authorization bypassCVE-2026-93428 · affects up to 2.13.1 · reported by WordfenceHigh 7.5
• Oct 1, 2026Ultimate Member: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-62059 · affects up to 2.13.1 · reported by PatchstackHigh 7.6
• Sep 19, 2026Ultimate Member: Does not escape a value derived from user supplied profile names before outputting it in the page titleCVE-2026-85680 · fixed in 2.13.1 · reported by WPScanHigh 8.8
• Sep 2, 2026Ultimate Member: Does not check whether a comment has been approvedCVE-2026-19251 · fixed in 2.13.0 · reported by WPScanMedium 5.3
• Aug 28, 2026Ultimate Member: Does not validate a submitted role selectionCVE-2026-19423 · fixed in 2.13.0 · reported by WPScanHigh 8.1
• Aug 25, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-18547 · affects up to 2.12.1 · reported by WordfenceMedium 6.4
• Jul 31, 2026Ultimate Member: Does not filter administrator-level capabilities from the roles it makes selectable on its registration formsCVE-2026-12251 · fixed in 2.12.1 · reported by WPScanHigh 8.1
• Jul 10, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Blind SQL InjectionCVE-2026-15290 · affects up to 2.10.1 · reported by WordfenceHigh 7.5
• Jul 6, 2026Ultimate Member: Does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profilesCVE-2026-11766 · fixed in 2.12.0 · reported by WPScanHigh 8
• Jul 3, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-8489 · affects up to 2.11.4 · reported by WordfenceMedium 6.4
• Jun 24, 2026Ultimate Member: Account TakeoverCVE-2026-7761 · affects up to 2.11.4 · reported by WordfenceHigh 8.8
• Apr 4, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-15064 · affects up to 2.11.1 · reported by WordfenceMedium 6.4
• Mar 27, 2026Ultimate Member: Sensitive Information ExposureCVE-2026-4248 · affects up to 2.11.2 · reported by WordfenceHigh 8
• Feb 18, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Reflected Cross-Site ScriptingCVE-2026-1404 · affects up to 2.11.1 · reported by WordfenceMedium 6.1
• Dec 20, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-13220 · affects up to 2.11.0 · reported by WordfenceMedium 6.4
• Dec 20, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Sensitive Information ExposureCVE-2025-12492 · affects up to 2.11.0 · reported by WordfenceMedium 5.3
• Dec 17, 2025Ultimate Member: Profile Privacy Setting BypassCVE-2025-14081 · affects up to 2.11.0 · reported by WordfenceMedium 4.3
• Dec 17, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-13217 · affects up to 2.11.0 · reported by WordfenceMedium 6.4
• May 7, 2025Ultimate Member: Improper Control of Generation of Code ('Code Injection')CVE-2025-47691 · affects up to 2.10.3 · reported by PatchstackMedium 5.5
• Mar 5, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Time-based SQL InjectionCVE-2025-1702 · affects up to 2.10.0 · reported by WordfenceHigh 7.5
• Feb 21, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Second-order SQL InjectionCVE-2024-12276 · affects up to 2.9.2 · reported by WordfenceMedium 5.3
• Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Information ExposureCVE-2025-0318 · affects up to 2.9.1 · reported by WordfenceMedium 5.3
• Jan 18, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Time-based SQL InjectionCVE-2025-0308 · affects up to 2.9.1 · reported by WordfenceHigh 7.5
• Nov 21, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Unauthorized profile picture updatesCVE-2024-10528 · affects up to 2.8.9 · reported by WordfenceMedium 4.3
• Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Cross-Site Request ForgeryCVE-2024-8520 · affects up to 2.8.6 · reported by WordfenceMedium 5.3
• Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-8519 · affects up to 2.8.6 · reported by WordfenceMedium 6.4
• May 2, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-2765 · affects up to 2.8.4 · reported by WordfenceMedium 5.4
• Mar 13, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: SQL InjectionCVE-2024-1071 · affects 2.1.3 to 2.8.2 · reported by Wordfence89% oddsCritical 9.8
• Mar 13, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-2123 · affects up to 2.8.3 · reported by Wordfence27% oddsHigh 7.2
• Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions.CVE-2023-31216 · affects up to 2.6.0 · reported by PatchstackMedium 4.3
• Jul 4, 2023Ultimate Member: Does not prevent visitors from creating user accounts with arbitrary capabilitiesCVE-2023-3460 · fixed in 2.6.7 · reported by WPScan72% oddsCritical 9.8
• Nov 29, 2022Ultimate Member: Remote Code ExecutionCVE-2022-3384 · affects up to 2.5.0 · reported by Wordfence3.0% oddsHigh 7.2
• Nov 29, 2022Ultimate Member: Remote Code ExecutionCVE-2022-3383 · affects up to 2.5.0 · reported by Wordfence3.0% oddsHigh 7.2
• Nov 29, 2022Ultimate Member: Directory traversalCVE-2022-3361 · affects up to 2.5.0 · reported by Wordfence2.7% oddsMedium 4.3
• Jun 13, 2022Ultimate Member: Stored Cross-Site ScriptingCVE-2022-1208 · affects up to 2.3.2 · fixed in 2.3.2 · reported by WordfenceMedium 6.4
• May 10, 2022Ultimate Member: Arbitrary redirectsCVE-2022-1209 · affects up to 2.3.1 · reported by WordfenceMedium 4.3
• May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · fixed in 2.1.20 · reported by WPScanMedium 5.4
• Jan 6, 2021The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.CVE-2020-36170 · fixed in 2.1.13 · reported by MITRE1.1% oddsMedium 5.3
• Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.CVE-2020-36157 · fixed in 2.1.12 · reported by MITRE3.0% oddsCritical 10
• Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.CVE-2020-36156 · fixed in 2.1.12 · reported by MITRE2.1% oddsCritical 9.9
• Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · fixed in 2.1.12 · reported by MITRE9.8% oddsCritical 10
• Jan 13, 2020Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remotCVE-2020-6859 · affects up to 2.1.2 · reported by MITRE2.2% oddsMedium 5.3
• Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.CVE-2019-14947 · fixed in 2.0.52 · reported by MITREMedium 5.4
• Aug 12, 2019The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.CVE-2019-14946 · fixed in 2.0.52 · reported by MITREMedium 5.4
• Aug 12, 2019The ultimate-member plugin before 2.0.54 for WordPress has XSS.CVE-2019-14945 · fixed in 2.0.54 · reported by MITREMedium 5.4
• Aug 12, 2019The ultimate-member plugin before 2.0.4 for WordPress has XSS.CVE-2018-20965 · fixed in 2.0.4 · reported by MITRE1.0% oddsMedium 6.1
• Aug 12, 2019The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.CVE-2016-10872 · fixed in 1.3.40 · reported by MITRE1.0% oddsMedium 6.1
• Aug 12, 2019The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.CVE-2015-9304 · fixed in 1.3.18 · reported by MITRE1.0% oddsMedium 6.1
• Jun 24, 2019An issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10271 · fixed in 2.0.40 · reported by MITREMedium 4.3
• Jun 21, 2019An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress.CVE-2019-10270 · fixed in 2.0.40 · reported by MITRE1.2% oddsHigh 8.8
• Oct 9, 2018Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0CVE-2018-17866 · fixed in 2.0.28 · reported by MITRE1.6% oddsMedium 6.1
• May 14, 2018Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profileCVE-2018-0590 · fixed in 2.0.4 · reported by vultures@jpcert.or.jp1.1% oddsMedium 4.3
• May 14, 2018Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms' CVE-2018-0589 · fixed in 2.0.4 · reported by vultures@jpcert.or.jp1.1% oddsMedium 4.3
• May 14, 2018the AJAX function of Ultimate Member plugin prior to version 2.0.4 for: Directory traversalCVE-2018-0588 · fixed in 2.0.4 · reported by vultures@jpcert.or.jp2.5% oddsHigh 7.5
• May 14, 2018Ultimate Member plugin prior to version 2.0.4 for: Unrestricted file uploadCVE-2018-0587 · fixed in 2.0.4 · reported by vultures@jpcert.or.jp1.0% oddsMedium 4.3
• May 14, 2018the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for: Directory traversalCVE-2018-0586 · fixed in 2.0.4 · reported by vultures@jpcert.or.jp1.6% oddsMedium 4.3
• May 14, 2018Ultimate Member plugin prior to version 2.0.4 for: Cross-site scriptingCVE-2018-0585 · fixed in 2.0.4 · reported by vultures@jpcert.or.jpMedium 5.4
• Apr 23, 2018Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input fieldCVE-2018-10234 · fixed in 2.0.11 · reported by MITREMedium 4.8
• Apr 23, 2018The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks.CVE-2018-10233 · fixed in 2.0.7 · reported by MITREHigh 8.8
• Sep 11, 2017Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web scrCVE-2015-8354 · fixed in 1.3.29 · reported by MITRE2.1% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.