PLUGIN SECURITY
Is Ultimate Member safe?
Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.
What this plugin does
- Slug:
ultimate-member - Author: Ultimate Member
- 200000+ active installs
- 88/100 rating (1444 reviews on wordpress.org)
- 13481338 all-time downloads
- On WordPress.org since 2015-01-21
communitymembermembershipuser profileUser Registration
Maintenance status
- Latest known version: 2.12.1
- Last updated: 2026-08-24 4:36pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.0+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
63 known CVEs on file for Ultimate Member.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-19423 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.13.0 | Improper Privilege Management | Unknown | < 2.13.0 | 2.13.0 | 2026-08-28 | ⚠ update needed |
| CVE-2026-18547 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.13.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.13.0 | 2.13.0 | 2026-08-05 | ⚠ update needed |
| CVE-2026-12251 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.1 | Improper Privilege Management | Unknown | < 2.12.1 | 2.12.1 | 2026-07-31 | ✓ fixed in latest |
| CVE-2026-11766 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.12.0 | 2.12.0 | 2026-07-06 | ✓ fixed in latest |
| CVE-2026-8489 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.12.0 | 2.12.0 | 2026-07-02 | ✓ fixed in latest |
| CVE-2026-7761 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 | Missing Authorization | High 8.8 | < 2.12.0 | 2.12.0 | 2026-06-23 | ✓ fixed in latest |
| CVE-2020-37169 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] <= 2.1.3 (unfixed) | — | Medium 5.5 | < 2.1.3 | 2.1.3 | 2026-05-13 | ✓ fixed in latest |
| CVE-2025-15064 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.11.2 | 2.11.2 | 2026-04-03 | ✓ fixed in latest |
+ 106 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-39659 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] <= 2.11.3 (unfixed) | — | Unknown | < 2.11.3 | 2.11.3 | 2026-02-17 | ✓ fixed in latest |
| CVE-2025-13220 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.11.1 | 2.11.1 | 2025-12-20 | ✓ fixed in latest |
| CVE-2025-12492 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 2.11.1 | 2.11.1 | 2025-12-19 | ✓ fixed in latest |
| CVE-2025-13217 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 2.11.1 | 2.11.1 | 2025-12-16 | ✓ fixed in latest |
| CVE-2025-14081 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.1 | Incorrect Authorization | Medium 4.3 | < 2.11.1 | 2.11.1 | 2025-12-16 | ✓ fixed in latest |
| CVE-2025-47691 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.4 | Improper Control of Generation of Code ('Code Injection') | Medium 5.5 | < 2.10.4 | 2.10.4 | 2025-05-07 | ✓ fixed in latest |
| CVE-2026-15290 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 2.10.2 | 2.10.2 | 2025-04-16 | ✓ fixed in latest |
| CVE-2024-12276 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 5.3 | < 2.10.0 | 2.10.0 | 2025-02-20 | ✓ fixed in latest |
| CVE-2024-10528 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.0 | Missing Authorization | Medium 4.3 | < 2.9.0 | 2.9.0 | 2024-11-20 | ✓ fixed in latest |
| CVE-2024-8519 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.8.7 | 2.8.7 | 2024-10-03 | ✓ fixed in latest |
| CVE-2024-8520 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.7 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 2.8.7 | 2.8.7 | 2024-10-03 | ✓ fixed in latest |
| CVE-2024-2765 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.8.5 | 2.8.5 | 2024-04-10 | ✓ fixed in latest |
| CVE-2024-2123 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.8.4 | 2.8.4 | 2024-03-08 | ✓ fixed in latest |
| CVE-2024-1071 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.8.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 2.8.3 | 2.8.3 | 2024-02-23 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.9 | — | Unknown | < 2.6.9 | 2.6.9 | 2023-08-09 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.9 | — | Unknown | < 2.6.9 | 2.6.9 | 2023-08-08 | ✓ fixed in latest |
| CVE-2023-3460 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.7 | Improper Privilege Management | Critical 9.8 | < 2.6.7 | 2.6.7 | 2023-06-29 | ✓ fixed in latest |
| CVE-2023-31216 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.6.7 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 2.6.7 | 2.6.7 | 2023-05-30 | ✓ fixed in latest |
| CVE-2022-3383 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Improper Control of Generation of Code ('Code Injection') | High 7.2 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ fixed in latest |
| CVE-2022-3384 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Improper Control of Generation of Code ('Code Injection') | High 7.2 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ fixed in latest |
| CVE-2022-3361 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.3 | < 2.5.1 | 2.5.1 | 2022-10-28 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.1 | — | Unknown | < 2.4.1 | 2.4.1 | 2022-07-15 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.2 | — | Unknown | < 2.4.2 | 2.4.2 | 2022-07-14 | ✓ fixed in latest |
| CVE-2022-1209 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.3.2 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 5.4 | < 2.3.2 | 2.3.2 | 2022-04-29 | ✓ fixed in latest |
| CVE-2022-1208 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.4.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.4.0 | 2.4.0 | 2022-03-21 | ✓ fixed in latest |
| CVE-2021-24306 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.1.20 | 2.1.20 | 2021-05-07 | ✓ fixed in latest |
| CVE-2020-36170 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.13 | — | Medium 5.3 | < 2.1.13 | 2.1.13 | 2020-12-09 | ✓ fixed in latest |
| CVE-2020-36155 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | Improper Privilege Management | Critical 9.8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ fixed in latest |
| CVE-2020-36156 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | Improper Privilege Management | High 8.8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ fixed in latest |
| CVE-2020-36157 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | — | Critical 9.8 | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.12 | — | Unknown | < 2.1.12 | 2.1.12 | 2020-11-09 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.7 | — | Unknown | < 2.1.7 | 2.1.7 | 2020-07-23 | ✓ fixed in latest |
| CVE-2020-6859 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.3 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 2.1.3 | 2.1.3 | 2020-01-13 | ✓ fixed in latest |
| CVE-2018-20965 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.4 | 2.0.4 | 2019-08-12 | ✓ fixed in latest |
| CVE-2019-14945 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.54 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.0.54 | 2.0.54 | 2019-07-22 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | — | Unknown | < 2.0.52 | 2.0.52 | 2019-07-13 | ✓ fixed in latest |
| CVE-2019-14946, CVE-2019-14947 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.0.52 | 2.0.52 | 2019-06-24 | ✓ fixed in latest |
| CVE-2019-14947 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.52 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.0.52 | 2.0.52 | 2019-06-24 | ✓ fixed in latest |
| CVE-2019-10271 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | — | Medium 4.3 | < 2.0.40 | 2.0.40 | 2019-06-15 | ✓ fixed in latest |
| CVE-2019-10270 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Weak Password Recovery Mechanism for Forgotten Password | High 8.8 | < 2.0.40 | 2.0.40 | 2019-06-15 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Unknown | < 2.0.46 | 2.0.46 | 2019-05-16 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Unknown | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Unknown | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Unknown | < 2.0.46 | 2.0.46 | 2019-05-13 | ✓ fixed in latest |
| CVE-2019-10673 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.0.40 | 2.0.40 | 2019-04-01 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Unknown | < 2.0.33 | 2.0.33 | 2018-11-27 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Unknown | < 2.0.33 | 2.0.33 | 2018-11-27 | ✓ fixed in latest |
| CVE-2018-17866 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.28 | 2.0.28 | 2018-10-06 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | 2018-08-28 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | 2018-08-09 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | 2018-08-09 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | 2018-08-08 | ✓ fixed in latest |
| CVE-2018-13136 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.18 | 2.0.18 | 2018-07-03 | ✓ fixed in latest |
| CVE-2018-0589 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | — | Medium 4.3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-0590 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | — | Medium 4.3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-0585, CVE-2018-0586, CVE-2018-0587, CVE-2018-0588, CVE-2018-0590, CVE-2018-20965, CVE-2018-0589 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-0588 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.40 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 2.0.40 | 2.0.40 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-0586 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-0587 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Unrestricted Upload of File with Dangerous Type | Medium 4.3 | < 2.0.4 | 2.0.4 | 2018-05-10 | ✓ fixed in latest |
| CVE-2018-10233 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.7 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 2.0.7 | 2.0.7 | 2018-04-23 | ✓ fixed in latest |
| CVE-2018-10234 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 2.0.11 | 2.0.11 | 2018-04-23 | ✓ fixed in latest |
| CVE-2018-6943 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.4 | 2.0.4 | 2018-02-14 | ✓ fixed in latest |
| CVE-2018-6944, CVE-2018-6943 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.4 | 2.0.4 | 2018-02-14 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.84 | — | Unknown | < 1.3.84 | 1.3.84 | 2017-04-17 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Unknown | < 1.3.76 | 1.3.76 | 2016-12-06 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Unknown | < 1.3.76 | 1.3.76 | 2016-12-06 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Unknown | < 1.3.65 | 1.3.65 | 2016-07-10 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Unknown | < 1.3.65 | 1.3.65 | 2016-07-10 | ✓ fixed in latest |
| CVE-2016-10872 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.40 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.3.40 | 1.3.40 | 2016-04-06 | ✓ fixed in latest |
| CVE-2015-8354 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.3.29 | 1.3.29 | 2015-12-02 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.29 | — | Unknown | < 1.3.29 | 1.3.29 | 2015-12-02 | ✓ fixed in latest |
| CVE-2015-9304 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.3.18 | 1.3.18 | 2015-08-20 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.2.995 | — | Unknown | < 1.2.995 | 1.2.995 | 2015-06-18 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.2.995 | — | Unknown | < 1.2.995 | 1.2.995 | 2015-06-18 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Unknown | < 1.0.84 | 1.0.84 | 2015-03-16 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Unknown | < 1.0.84 | 1.0.84 | 2015-03-10 | ✓ fixed in latest |
| CVE-2022-2445 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.5.1 | — | Unknown | < 2.5.1 | 2.5.1 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 2.9.2 | 2.9.2 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.9.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 2.9.2 | 2.9.2 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.10.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 2.10.1 | 2.10.1 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.3 | — | Unknown | < 2.11.3 | 2.11.3 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2 | — | Unknown | < 2.11.2 | 2.11.2 | 0000-00-00 | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.1.7 | — | Unknown | < 2.1.7 | 2.1.7 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.46 | — | Unknown | < 2.0.46 | 2.0.46 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.33 | — | Unknown | < 2.0.33 | 2.0.33 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.0.22 | — | Unknown | < 2.0.22 | 2.0.22 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.76 | — | Unknown | < 1.3.76 | 1.3.76 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.3.65 | — | Unknown | < 1.3.65 | 1.3.65 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] >= 1.2.98 - <= 1.2.994 | — | Unknown | 1.2.98–1.2.994 | 1.2.994 | — | ✓ fixed in latest |
| — | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 1.0.84 | — | Unknown | < 1.0.84 | 1.0.84 | — | ✓ fixed in latest |
| — | Ultimate Member < 1.0.84 - Multiple Vulnerabilities | — | Unknown | < 1.0.84 | 1.0.84 | — | ✓ fixed in latest |
| — | Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS) | — | Unknown | < 1.2.995 | 1.2.995 | — | ✓ fixed in latest |
| — | Ultimate Member < 1.3.65 - Local File Inclusion | — | Unknown | < 1.3.65 | 1.3.65 | — | ✓ fixed in latest |
| — | Ultimate Member < 1.3.76 - Unauthenticated Change Passwords | — | Unknown | < 1.3.76 | 1.3.76 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload | — | Unknown | < 2.0.22 | 2.0.22 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 2.0.22 | 2.0.22 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.0.33 - Cross-Site Request Forgery (CSRF) | — | Unknown | < 2.0.33 | 2.0.33 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.0.46 - Multiple Vulnerabilities | — | Unknown | < 2.0.46 | 2.0.46 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.1.7 - Unauthenticated Open Redirect | — | Unknown | < 2.1.7 | 2.1.7 | — | ✓ fixed in latest |
| CVE-2025-0318 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.9.2 - Information Exposure | — | Unknown | < 2.9.2 | 2.9.2 | — | ✓ fixed in latest |
| CVE-2025-0308 | Ultimate Member < 2.9.2 - Unauthenticated SQL Injection | — | Unknown | < 2.9.2 | 2.9.2 | — | ✓ fixed in latest |
| CVE-2025-1702 | Ultimate Member < 2.10.1 - Unauthenticated SQLi | — | Unknown | < 2.10.1 | 2.10.1 | — | ✓ fixed in latest |
| — | Ultimate Member < 2.10.2 - Unauthenticated Blind SQL Injection | — | Unknown | < 2.10.2 | 2.10.2 | — | ✓ fixed in latest |
| CVE-2026-1404 | Ultimate Member < 2.11.2 - Reflected Cross-Site Scripting via Filter Parameters | — | Unknown | < 2.11.2 | 2.11.2 | — | ✓ fixed in latest |
| CVE-2026-4248 | Ultimate Member < 2.11.3 - Contributor+ Account Takeover via Shortcode Template Tag | — | Unknown | < 2.11.3 | 2.11.3 | — | ✓ fixed in latest |
How to fix it
Keep Ultimate Member updated — 2.12.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- BuddyPress — 90000+ active installs — 82/100 (375) — max PHP <8.0
- Simple Membership — 40000+ active installs — 92/100 (475) — max PHP 8.4
- Ultimate Member – reCAPTCHA — 20000+ active installs — 74/100 (11) — max PHP 8.4
- wpForo Forum — 20000+ active installs — 94/100 (390)
- Asgaros Forum — 10000+ active installs — 96/100 (208)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.