Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
High
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure
Medium
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation
High
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Medium
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation
High
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
Medium
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
High
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
Medium
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
High
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
Medium
Ultimate Member <= 2.11.3 - Missing Authorization
Medium
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
Medium
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Medium
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Medium
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call
High
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
High
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
High
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
Medium
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
Medium
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
High
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
Medium
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
Medium
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
High
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Critical
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery
Medium
August 8, 2023
Patched in ["2.6.9"]
Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
Critical
Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication
Medium
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal
Medium
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
Medium
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
High
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
High
Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting
Medium
July 15, 2022
Patched in ["2.4.1"]
Ultimate Member <= 2.4.1 - Username Enumeration
High
July 14, 2022
Patched in ["2.4.2"]
Ultimate Member <= 2.3.1 - Arbitrary Redirect
Medium
Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.1.19 - Reflected Cross-Site Scripting
Medium
Ultimate Member <= 2.1.12 - Cross-Site Scripting
Medium
Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles
Critical
Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta
Critical
Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update
Critical
Ultimate Member <= 2.1.6 - Open Redirect
Medium
July 23, 2020
Patched in ["2.1.7"]
Ultimate Member <= 2.1.2 - Insecure Direct Object Reference
Medium
Ultimate Member <= 1.3.88 - Cross Site Scripting
Medium
Ultimate Member <= 2.0.3 - Unauthorized Image File Upload
Medium
Ultimate Member <= 2.0.3 - Directory Traversal
Medium
Ultimate Member <= 2.0.3 - Cross Site Scripting
Medium
Ultimate Member <= 2.0.53 - Cross-Site Scripting
Medium
Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting
Medium
Ultimate Member <= 2.0.39 - Unauthorized Profile Modification
Medium
Ultimate Member <= 2.0.39 - Privilege Escalation
High
Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting
Medium
May 13, 2019
Patched in ["2.0.46"]
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read
Critical
May 13, 2019
Patched in ["2.0.46"]
Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting
Medium
May 13, 2019
Patched in ["2.0.46"]
Ultimate Member <= 2.0.39 - Cross-Site Request Forgery
High
Ultimate Member <= 2.0.32 - Cross-Site Request Forgery
Medium
November 27, 2018
Patched in ["2.0.33"]
Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities
Medium
Ultimate Member <= 2.0.21 - Cross-Site Scripting
Medium
August 9, 2018
Patched in ["2.0.22"]
Ultimate Member <= 2.0.21 - Arbitrary File Upload
High
August 8, 2018
Patched in ["2.0.22"]
Ultimate Member <= 2.0.17 - Authenticated Cross-Site Scripting
Medium
Ultimate Member <= 2.0.3 - Improper Access Control
Medium
Ultimate Member < 2.0.4 - Insecure Direct Object Reference
Medium
Ultimate Member <= 2.0.39 - Directory Traversal
Medium
Ultimate Member < 2.0.4 - Authenticated Unrestricted File Upload
Medium
Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting
Medium
Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues
High
Ultimate Member <= 2.0.3 - Cross-Site Scripting
Medium
Ultimate Member <= 2.0 - Cross-Site Scripting
Medium
Ultimate Member <= 1.3.83 - Shortcode Injection
Critical
April 17, 2017
Patched in ["1.3.84"]
Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset
Critical
December 6, 2016
Patched in ["1.3.76"]
Ultimate Member <= 1.3.64 - Local File Inclusion
Critical
July 10, 2016
Patched in ["1.3.65"]
Ultimate Member <= 1.3.39 - Cross-Site Scripting
Medium
Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting
Medium
Ultimate Member <= 1.3.17 - Cross-Site Scripting
Medium
Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting
High
June 18, 2015
Patched in ["1.3.0"]
Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete
Critical
March 10, 2015
Patched in ["1.0.84"]