CVEs we hold for Ultimatemember
Records whose assigning authority named Ultimatemember as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-8489Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea…ultimatemember Ultimate Member – User Profile…
CVE-2026-7761Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosureultimatemember Ultimate Member – User Profile…
CVE-2026-4248Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via…ultimatemember Ultimate Member – User Profile…
CVE-2026-18547Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with…ultimatemember Ultimate Member – User Profile…
CVE-2026-15290Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <=…ultimatemember Ultimate Member – User Profile…
CVE-2026-1404Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parametersultimatemember Ultimate Member – User Profile…
CVE-2025-1702Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameterultimatemember Ultimate Member – User Profile…
CVE-2025-15064Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgetsultimatemember Ultimate Member – User Profile…
CVE-2025-14081Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypassultimatemember Ultimate Member – User Profile…
CVE-2025-13746ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Nameultimatemember ForumWP – Forum & Discussion Board
CVE-2025-13220Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesultimatemember Ultimate Member – User Profile…
CVE-2025-13217Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'ultimatemember Ultimate Member – User Profile…
CVE-2025-12492Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <=…ultimatemember Ultimate Member – User Profile…
CVE-2025-0318Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1…ultimatemember Ultimate Member – User Profile…
CVE-2025-0308Ultimate Member <= 2.9.1 - Unauthenticated SQL Injectionultimatemember Ultimate Member – User Profile…
CVE-2024-8520Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Changeultimatemember Ultimate Member – User Profile…
CVE-2024-8519Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-8428ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+)…ultimatemember ForumWP – Forum & Discussion Board
CVE-2024-2765Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-2123Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
CVE-2024-12276Ultimate Member <= 2.9.2 - Authenticated SQL Injectionultimatemember Ultimate Member – User Profile…
CVE-2024-11204ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameterultimatemember ForumWP – Forum & Discussion Board
CVE-2024-10880JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scriptingultimatemember JobBoardWP – Job Board Listings and…
CVE-2024-10879ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scriptingultimatemember ForumWP – Forum & Discussion Board
CVE-2024-10528Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Updateultimatemember Ultimate Member – User Profile…
CVE-2022-3384Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited…ultimatemember Ultimate Member – User Profile…
CVE-2022-3383Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote…ultimatemember Ultimate Member – User Profile…
CVE-2022-3361Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+)…ultimatemember Ultimate Member – User Profile…
CVE-2022-1209Ultimate Member <= 2.3.1 - Arbitrary Redirectultimatemember Ultimate Member – User Profile…
CVE-2022-1208Ultimate Member <= 2.3.2 - Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile…
31 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.