CVEs we hold for Ultimate
Records whose assigning authority named Ultimate as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-85680Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleUnknown Ultimate Member
CVE-2026-8489Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea…ultimatemember Ultimate Member – User Profile…
CVE-2026-7761Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosureultimatemember Ultimate Member – User Profile…
CVE-2026-75861Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized RedemptionUnknown Ultimate Gift Cards for WooCommerce
CVE-2026-70560Ultimate POS Stored XSS via First Name Field in Leave NotificationsUltimate POS (Stock Management & Point of Sale)
CVE-2026-63082Perfect Support Ticketing System 1.7 Broken Access Control via Agent AssignmentUltimate Fosters Perfect Support Ticketing & Document…
CVE-2026-63081Perfect Support Ticketing System 1.7 Stored XSS via Ticket Notes FieldUltimate Fosters Perfect Support Ticketing & Document…
CVE-2026-4259Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctionsUnknown ultimate-woocommerce-auction-pro
CVE-2026-4248Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via…ultimatemember Ultimate Member – User Profile…
CVE-2026-4110Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_listUnknown ultimate-woocommerce-auction-pro
CVE-2026-19439Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via…Unknown Ultimate Gift Cards for WooCommerce
CVE-2026-19436Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted PurchaseUnknown Ultimate Gift Cards for WooCommerce
CVE-2026-19423Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile FormsUnknown Ultimate Member
CVE-2026-19251Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile ActivityUnknown Ultimate Member
CVE-2026-18547Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with…ultimatemember Ultimate Member – User Profile…
CVE-2026-15382Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fontsUnknown Ultimate Addons for WPBakery Page Builder
CVE-2026-15290Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <=…ultimatemember Ultimate Member – User Profile…
CVE-2026-14921Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons ShortcodeUnknown Ultimate Addons for WPBakery Page Builder
CVE-2026-1404Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parametersultimatemember Ultimate Member – User Profile…
CVE-2026-12251Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldUnknown Ultimate Member
CVE-2026-11766Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile FieldsUnknown Ultimate Member
CVE-2025-9703Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSSUnknown Ultimate Addons for Elementor (Formerly Elementor…
CVE-2025-67474WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerabilityUltimate Member ForumWP
CVE-2025-49929WordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks
CVE-2025-48234WordPress Ultimate Blocks plugin <= 3.3.0 - Cross Site Scripting (XSS) VulnerabilityUltimate Blocks
CVE-2025-47691WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerabilityUltimate Member
CVE-2025-47493WordPress Ultimate Blocks plugin <= 3.2.9 - Cross Site Scripting (XSS) VulnerabilityUltimate Blocks
CVE-2025-31077WordPress Ultimate Blocks plugin <= 3.2.7 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks
CVE-2025-2918Ultimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via…ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2025-1703Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameterultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2025-1702Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameterultimatemember Ultimate Member – User Profile…
CVE-2025-15665BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode FieldUnknown Ultimate Before After Image Slider & Gallery
CVE-2025-15664BEAF < 4.7.19 - Author+ Stored XSS via Before LabelUnknown Ultimate Before After Image Slider & Gallery
CVE-2025-15663BEAF < 4.7.19 - Author+ Stored XSS via After LabelUnknown Ultimate Before After Image Slider & Gallery
CVE-2025-15064Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgetsultimatemember Ultimate Member – User Profile…
CVE-2025-14434Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content DisclosureUnknown Ultimate Post Kit Addons for Elementor
CVE-2025-14081Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypassultimatemember Ultimate Member – User Profile…
CVE-2025-13746ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Nameultimatemember ForumWP – Forum & Discussion Board
CVE-2025-13220Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesultimatemember Ultimate Member – User Profile…
CVE-2025-13217Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'ultimatemember Ultimate Member – User Profile…
CVE-2025-1312Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2025-12492Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <=…ultimatemember Ultimate Member – User Profile…
CVE-2025-0318Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1…ultimatemember Ultimate Member – User Profile…
CVE-2025-0308Ultimate Member <= 2.9.1 - Unauthenticated SQL Injectionultimatemember Ultimate Member – User Profile…
CVE-2024-8520Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Changeultimatemember Ultimate Member – User Profile…
CVE-2024-8519Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-8428ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+)…ultimatemember ForumWP – Forum & Discussion Board
CVE-2024-5882Ultimate Classified Listings < 1.3 - Unauthenticated LFIUnknown Ultimate Classified Listings
CVE-2024-54367WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerabilityUltimate Member ForumWP
CVE-2024-4268Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via…ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2024-37457WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerabilityUltimate Blocks – Gutenberg Blocks Plugin
CVE-2024-3513Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title…ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2024-2765Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-2123Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-1663Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSSUnknown Ultimate Noindex Nofollow Tool II
CVE-2024-12276Ultimate Member <= 2.9.2 - Authenticated SQL Injectionultimatemember Ultimate Member – User Profile…
CVE-2024-11204ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameterultimatemember ForumWP – Forum & Discussion Board
CVE-2024-10880JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scriptingultimatemember JobBoardWP – Job Board Listings and…
CVE-2024-10879ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scriptingultimatemember ForumWP – Forum & Discussion Board
CVE-2024-10528Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Updateultimatemember Ultimate Member – User Profile…
CVE-2023-7196Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRFUnknown Ultimate Noindex Nofollow Tool
CVE-2023-6732Ultimate Maps by Supsystic < 1.2.16 - Admin+ Stored XSSUnknown Ultimate Maps by Supsystic
CVE-2023-6692Ultimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metaboxultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for…
CVE-2023-41238WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)UltimatelySocial Social Media Share Buttons & Social…
CVE-2023-31216WordPress Ultimate Member Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)Ultimate Member
CVE-2023-2803Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSSUnknown Ultimate Addons for Contact Form 7
CVE-2023-2802Ultimate Addons for Contact Form 7 < 3.1.29 - Admin+ Stored XSSUnknown Ultimate Addons for Contact Form 7
CVE-2023-0280Ultimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSSUnknown Ultimate Carousel For Elementor
CVE-2023-0267Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSSUnknown Ultimate Carousel For WPBakery Page Builder
CVE-2022-3384Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited…ultimatemember Ultimate Member – User Profile…
CVE-2022-3383Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote…ultimatemember Ultimate Member – User Profile…
CVE-2022-3361Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+)…ultimatemember Ultimate Member – User Profile…
CVE-2022-1470Ultimate WooCommerce CSV Importer <= 2.0 - Reflected Cross-Site ScriptingUnknown Ultimate WooCommerce CSV Importer
CVE-2022-1209Ultimate Member <= 2.3.1 - Arbitrary Redirectultimatemember Ultimate Member – User Profile…
CVE-2022-1208Ultimate Member <= 2.3.2 - Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2021-24993Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings UpdateUnknown Ultimate Product Catalog – WordPress Catalog Plugin
CVE-2021-24968Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ CreationUnknown Ultimate FAQ – WordPress FAQ and Accordion Plugin
CVE-2021-24817Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site ScriptingUnknown Ultimate Nofollow
CVE-2021-24306Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)Ultimate Member – User Profile, User Registration, Login &…
CVE-2021-24271Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSSUnknown Ultimate Addons for Elementor
CVE-2020-37169WordPress Plugin ultimate-member 2.1.3 Local File InclusionUltimate Member ultimate-member
CVE-2019-25763WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication BypassUltimatebeaver Ultimate Addons for Beaver Builder
CVE-2018-25352WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_idultimate-form-builder-lite Ultimate Form Builder Lite
106 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.