SEGURIDAD DE PLUGINS
¿Es seguro Ultimate Member?
Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.
Qué hace este plugin
- Slug:
ultimate-member - Autor: Ultimate Member
- 200000+ instalaciones activas
- 88/100 calificación (1444 reseñas en wordpress.org)
- 13481338 descargas totales
- En WordPress.org desde 2015-01-21
communitymembermembershipuser profileUser Registration
Estado de mantenimiento
- Última versión conocida: 2.12.1
- Última actualización: 2026-08-24 4:36pm GMT
- Probado hasta WordPress: 7.1
- Requiere PHP: 7.0+
- PHP máximo soportado (analizado): 8.4
Vulnerabilidades conocidas
63 CVEs conocidos registrados para Ultimate Member.
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-19423 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.13.0 | Gestión incorrecta de privilegios | Desconocido | < 2.13.0 | 2.13.0 | 2026-08-28 | ⚠ necesita actualización |
| CVE-2026-18547 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.13.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.13.0 | 2.13.0 | 2026-08-05 | ⚠ necesita actualización |
| CVE-2026-12251 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.1 | Gestión incorrecta de privilegios | Desconocido | < 2.12.1 | 2.12.1 | 2026-07-31 | ✓ corregido en la última versión |
| CVE-2026-11766 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Desconocido | < 2.12.0 | 2.12.0 | 2026-07-06 | ✓ corregido en la última versión |
| CVE-2026-8489 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.12.0 | 2.12.0 | 2026-07-02 | ✓ corregido en la última versión |
| CVE-2026-7761 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Falta de control de autorización | Alta 8,8 | < 2.12.0 | 2.12.0 | 2026-06-23 | ✓ corregido en la última versión |
| CVE-2020-37169 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] <= 2.1.3 (unfixed) | — | Media 5,5 | < 2.1.3 | 2.1.3 | 2026-05-13 | ✓ corregido en la última versión |
| CVE-2025-15064 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.11.2 | 2.11.2 | 2026-04-03 | ✓ corregido en la última versión |
+ 106 vulnerabilidades conocidas más
| CVE | Vulnerabilidad | Tipo | Gravedad | Afectadas | Corregido en | Publicado | Estado |
|---|---|---|---|---|---|---|---|
| CVE-2026-39659 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] <= 2.11.3 (unfixed) | — | Desconocido | < 2.11.3 | 2.11.3 | 2026-02-17 | ✓ corregido en la última versión |
| CVE-2025-13220 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.11.1 | 2.11.1 | 2025-12-20 | ✓ corregido en la última versión |
| CVE-2025-12492 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Exposición de información sensible a un actor no autorizado | Media 5,3 | < 2.11.1 | 2.11.1 | 2025-12-19 | ✓ corregido en la última versión |
| CVE-2025-13217 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,4 | < 2.11.1 | 2.11.1 | 2025-12-16 | ✓ corregido en la última versión |
| CVE-2025-14081 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Autorización incorrecta | Media 4,3 | < 2.11.1 | 2.11.1 | 2025-12-16 | ✓ corregido en la última versión |
| CVE-2025-47691 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.4 | Control incorrecto de la generación de código (inyección de código) | Media 5,5 | < 2.10.4 | 2.10.4 | 2025-05-07 | ✓ corregido en la última versión |
| CVE-2026-15290 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.2 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,5 | < 2.10.2 | 2.10.2 | 2025-04-16 | ✓ corregido en la última versión |
| CVE-2024-12276 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.0 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Media 5,3 | < 2.10.0 | 2.10.0 | 2025-02-20 | ✓ corregido en la última versión |
| CVE-2024-10528 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.0 | Falta de control de autorización | Media 4,3 | < 2.9.0 | 2.9.0 | 2024-11-20 | ✓ corregido en la última versión |
| CVE-2024-8519 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.8.7 | 2.8.7 | 2024-10-03 | ✓ corregido en la última versión |
| CVE-2024-8520 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7 | Falsificación de petición en sitios cruzados (CSRF) | Media 4,3 | < 2.8.7 | 2.8.7 | 2024-10-03 | ✓ corregido en la última versión |
| CVE-2024-2765 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.5 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.8.5 | 2.8.5 | 2024-04-10 | ✓ corregido en la última versión |
| CVE-2024-2123 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.8.4 | 2.8.4 | 2024-03-08 | ✓ corregido en la última versión |
| CVE-2024-1071 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.3 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Crítica 9,8 | < 2.8.3 | 2.8.3 | 2024-02-23 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.9 | — | Desconocido | < 2.6.9 | 2.6.9 | 2023-08-09 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.9 | — | Desconocido | < 2.6.9 | 2.6.9 | 2023-08-08 | ✓ corregido en la última versión |
| CVE-2023-3460 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.7 | Gestión incorrecta de privilegios | Crítica 9,8 | < 2.6.7 | 2.6.7 | 2023-06-29 | ✓ corregido en la última versión |
| CVE-2023-31216 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.7 | Falsificación de petición en sitios cruzados (CSRF) | Media 4,3 | < 2.6.7 | 2.6.7 | 2023-05-30 | ✓ corregido en la última versión |
| CVE-2022-3383 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Control incorrecto de la generación de código (inyección de código) | Alta 7,2 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ corregido en la última versión |
| CVE-2022-3384 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Control incorrecto de la generación de código (inyección de código) | Alta 7,2 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ corregido en la última versión |
| CVE-2022-3361 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 4,3 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.1 | — | Desconocido | < 2.4.1 | 2.4.1 | 2022-07-15 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.2 | — | Desconocido | < 2.4.2 | 2.4.2 | 2022-07-14 | ✓ corregido en la última versión |
| CVE-2022-1209 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.3.2 | Redirección de URL a un sitio no confiable (Open Redirect) | Media 5,4 | < 2.3.2 | 2.3.2 | 2022-04-29 | ✓ corregido en la última versión |
| CVE-2022-1208 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.0 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.4.0 | 2.4.0 | 2022-03-21 | ✓ corregido en la última versión |
| CVE-2021-24306 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.20 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.1.20 | 2.1.20 | 2021-05-07 | ✓ corregido en la última versión |
| CVE-2020-36170 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.13 | — | Media 5,3 | < 2.1.13 | 2.1.13 | 2020-12-09 | ✓ corregido en la última versión |
| CVE-2020-36155 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | Gestión incorrecta de privilegios | Crítica 9,8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ corregido en la última versión |
| CVE-2020-36156 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | Gestión incorrecta de privilegios | Alta 8,8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ corregido en la última versión |
| CVE-2020-36157 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | — | Crítica 9,8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | — | Desconocido | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.7 | — | Desconocido | < 2.1.7 | 2.1.7 | 2020-07-23 | ✓ corregido en la última versión |
| CVE-2020-6859 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.3 | Elusión de autorización mediante una clave controlada por el usuario | Media 5,3 | < 2.1.3 | 2.1.3 | 2020-01-13 | ✓ corregido en la última versión |
| CVE-2018-20965 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.0.4 | 2.0.4 | 2019-08-12 | ✓ corregido en la última versión |
| CVE-2019-14945 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.54 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.0.54 | 2.0.54 | 2019-07-22 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | — | Desconocido | < 2.0.52 | 2.0.52 | 2019-07-13 | ✓ corregido en la última versión |
| CVE-2019-14946, CVE-2019-14947 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.0.52 | 2.0.52 | 2019-06-24 | ✓ corregido en la última versión |
| CVE-2019-14947 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.0.52 | 2.0.52 | 2019-06-24 | ✓ corregido en la última versión |
| CVE-2019-10271 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | — | Media 4,3 | < 2.0.40 | 2.0.40 | 2019-06-15 | ✓ corregido en la última versión |
| CVE-2019-10270 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Mecanismo débil de recuperación de contraseña olvidada | Alta 8,8 | < 2.0.40 | 2.0.40 | 2019-06-15 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Desconocido | < 2.0.46 | 2.0.46 | 2019-05-16 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Desconocido | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Desconocido | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Desconocido | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ corregido en la última versión |
| CVE-2019-10673 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Falsificación de petición en sitios cruzados (CSRF) | Alta 8,8 | < 2.0.40 | 2.0.40 | 2019-04-01 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Desconocido | < 2.0.33 | 2.0.33 | 2018-11-27 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Desconocido | < 2.0.33 | 2.0.33 | 2018-11-27 | ✓ corregido en la última versión |
| CVE-2018-17866 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.28 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.0.28 | 2.0.28 | 2018-10-06 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | 2018-08-28 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | 2018-08-09 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | 2018-08-09 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | 2018-08-08 | ✓ corregido en la última versión |
| CVE-2018-13136 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.18 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.0.18 | 2.0.18 | 2018-07-03 | ✓ corregido en la última versión |
| CVE-2018-0589 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | — | Media 4,3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-0590 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | — | Media 4,3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 5,4 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-0588 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Alta 7,5 | < 2.0.40 | 2.0.40 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-0586 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) | Media 4,3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-0587 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Carga de archivos sin restricción de tipo peligroso | Media 4,3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ corregido en la última versión |
| CVE-2018-10233 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.7 | Falsificación de petición en sitios cruzados (CSRF) | Alta 8,8 | < 2.0.7 | 2.0.7 | 2018-04-23 | ✓ corregido en la última versión |
| CVE-2018-10234 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.11 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 4,8 | < 2.0.11 | 2.0.11 | 2018-04-23 | ✓ corregido en la última versión |
| CVE-2018-6943 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.0.4 | 2.0.4 | 2018-02-14 | ✓ corregido en la última versión |
| CVE-2018-6944, CVE-2018-6943 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 2.0.4 | 2.0.4 | 2018-02-14 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.84 | — | Desconocido | < 1.3.84 | 1.3.84 | 2017-04-17 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Desconocido | < 1.3.76 | 1.3.76 | 2016-12-06 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Desconocido | < 1.3.76 | 1.3.76 | 2016-12-06 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Desconocido | < 1.3.65 | 1.3.65 | 2016-07-10 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Desconocido | < 1.3.65 | 1.3.65 | 2016-07-10 | ✓ corregido en la última versión |
| CVE-2016-10872 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.40 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.3.40 | 1.3.40 | 2016-04-06 | ✓ corregido en la última versión |
| CVE-2015-8354 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.29 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.3.29 | 1.3.29 | 2015-12-02 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.29 | — | Desconocido | < 1.3.29 | 1.3.29 | 2015-12-02 | ✓ corregido en la última versión |
| CVE-2015-9304 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.18 | Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) | Media 6,1 | < 1.3.18 | 1.3.18 | 2015-08-20 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.2.995 | — | Desconocido | < 1.2.995 | 1.2.995 | 2015-06-18 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.2.995 | — | Desconocido | < 1.2.995 | 1.2.995 | 2015-06-18 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Desconocido | < 1.0.84 | 1.0.84 | 2015-03-16 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Desconocido | < 1.0.84 | 1.0.84 | 2015-03-10 | ✓ corregido en la última versión |
| CVE-2022-2445 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | — | Desconocido | < 2.5.1 | 2.5.1 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.2 | Exposición de información sensible a un actor no autorizado | Media 5,3 | < 2.9.2 | 2.9.2 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.2 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,5 | < 2.9.2 | 2.9.2 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.1 | Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) | Alta 7,5 | < 2.10.1 | 2.10.1 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.3 | — | Desconocido | < 2.11.3 | 2.11.3 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2 | — | Desconocido | < 2.11.2 | 2.11.2 | 0000-00-00 | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.7 | — | Desconocido | < 2.1.7 | 2.1.7 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Desconocido | < 2.0.46 | 2.0.46 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Desconocido | < 2.0.33 | 2.0.33 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Desconocido | < 2.0.22 | 2.0.22 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Desconocido | < 1.3.76 | 1.3.76 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Desconocido | < 1.3.65 | 1.3.65 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] >= 1.2.98 - <= 1.2.994 | — | Desconocido | 1.2.98–1.2.994 | 1.2.994 | — | ✓ corregido en la última versión |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Desconocido | < 1.0.84 | 1.0.84 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 1.0.84 - Multiple Vulnerabilities | — | Desconocido | < 1.0.84 | 1.0.84 | — | ✓ corregido en la última versión |
| — | Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS) | — | Desconocido | < 1.2.995 | 1.2.995 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 1.3.65 - Local File Inclusion | — | Desconocido | < 1.3.65 | 1.3.65 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 1.3.76 - Unauthenticated Change Passwords | — | Desconocido | < 1.3.76 | 1.3.76 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload | — | Desconocido | < 2.0.22 | 2.0.22 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS) | — | Desconocido | < 2.0.22 | 2.0.22 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.0.33 - Cross-Site Request Forgery (CSRF) | — | Desconocido | < 2.0.33 | 2.0.33 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.0.46 - Multiple Vulnerabilities | — | Desconocido | < 2.0.46 | 2.0.46 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.1.7 - Unauthenticated Open Redirect | — | Desconocido | < 2.1.7 | 2.1.7 | — | ✓ corregido en la última versión |
| CVE-2025-0318 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure | — | Desconocido | < 2.9.2 | 2.9.2 | — | ✓ corregido en la última versión |
| CVE-2025-0308 | Ultimate Member < 2.9.2 - Unauthenticated SQL Injection | — | Desconocido | < 2.9.2 | 2.9.2 | — | ✓ corregido en la última versión |
| CVE-2025-1702 | Ultimate Member < 2.10.1 - Unauthenticated SQLi | — | Desconocido | < 2.10.1 | 2.10.1 | — | ✓ corregido en la última versión |
| — | Ultimate Member < 2.10.2 - Unauthenticated Blind SQL Injection | — | Desconocido | < 2.10.2 | 2.10.2 | — | ✓ corregido en la última versión |
| CVE-2026-1404 | Ultimate Member < 2.11.2 - Reflected Cross-Site Scripting via Filter Parameters | — | Desconocido | < 2.11.2 | 2.11.2 | — | ✓ corregido en la última versión |
| CVE-2026-4248 | Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag | — | Desconocido | < 2.11.3 | 2.11.3 | — | ✓ corregido en la última versión |
Cómo solucionarlo
Mantén Ultimate Member actualizado — 2.12.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.
Alternativas más seguras / más establecidas
- BuddyPress — 90000+ instalaciones activas — 82/100 (375) — PHP máx. <8.0
- Simple Membership — 40000+ instalaciones activas — 92/100 (475) — PHP máx. 8.4
- Ultimate Member – reCAPTCHA — 20000+ instalaciones activas — 74/100 (11) — PHP máx. 8.4
- wpForo Forum — 20000+ instalaciones activas — 94/100 (390)
- Asgaros Forum — 10000+ instalaciones activas — 96/100 (208)
Verifica tu propio sitio WordPress
Ejecuta un escaneo pasivo gratis ahora, o crea una cuenta gratuita e instala el plugin de WP Clinic para un escaneo profundo de toda tu cuenta de hosting y reparación asistida por IA.