WordPress ultimate-member has 42 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-1071 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | critical | 9.8 | >=2.1.3 and <2.8.3 | 2.8.3 |
| CVE-2023-3460 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effecti | critical | 9.8 | <2.6.7 | 2.6.7 |
| CVE-2024-2123 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.2 | <2.8.4 | 2.8.4 |
| CVE-2020-36155 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. A | critical | 10.0 | <2.1.12 | 2.1.12 |
| CVE-2022-3383 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_v | high | 7.2 | <=2.5.0 | – |
| CVE-2022-3384 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dro | high | 7.2 | <=2.5.0 | – |
| CVE-2020-36157 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. | critical | 10.0 | <2.1.12 | 2.1.12 |
| CVE-2022-3361 | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient inp | medium | 4.3 | <=2.5.0 | – |
| CVE-2018-0588 | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attacker | high | 7.5 | <2.0.4 | 2.0.4 |
| CVE-2020-6859 | Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for W | medium | 5.3 | <=2.1.2 | – |
| CVE-2015-8354 | Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inje | medium | 6.1 | <=1.3.28 | – |
| CVE-2020-36156 | An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update | critical | 9.9 | <2.1.12 | 2.1.12 |
| CVE-2019-10673 | A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to b | high | 8.8 | <2.0.40 | 2.0.40 |
| CVE-2018-17866 | Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membershi | medium | 6.1 | <2.0.28 | 2.0.28 |
| CVE-2018-0586 | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote au | medium | 4.3 | <2.0.4 | 2.0.4 |
| CVE-2018-13136 | The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. | medium | 6.1 | <2.0.18 | 2.0.18 |
| CVE-2019-10270 | An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verificati | high | 8.8 | <2.0.40 | 2.0.40 |
| CVE-2018-6944 | core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails | medium | 6.1 | =2.0 | – |
| CVE-2020-36170 | The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. | medium | 5.3 | <2.1.13 | 2.1.13 |
| CVE-2018-0589 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new | medium | 4.3 | <2.0.4 | 2.0.4 |
| CVE-2018-0590 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the | medium | 4.3 | <2.0.4 | 2.0.4 |
| CVE-2015-9304 | The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. | medium | 6.1 | <1.3.18 | 1.3.18 |
| CVE-2016-10872 | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. | medium | 6.1 | <1.3.40 | 1.3.40 |
| CVE-2018-0587 | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to u | medium | 4.3 | <2.0.4 | 2.0.4 |
| CVE-2018-20965 | The ultimate-member plugin before 2.0.4 for WordPress has XSS. | medium | 6.1 | <2.0.4 | 2.0.4 |
| CVE-2018-0585 | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrar | medium | 5.4 | <2.0.4 | 2.0.4 |
| CVE-2022-1208 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user pr | medium | 6.4 | <=2.3.2 | – |
| CVE-2019-14947 | The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. | medium | 5.4 | <2.0.52 | 2.0.52 |
| CVE-2019-14945 | The ultimate-member plugin before 2.0.54 for WordPress has XSS. | medium | 5.4 | <2.0.54 | 2.0.54 |
| CVE-2019-10271 | An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It | medium | 4.3 | <2.0.40 | 2.0.40 |
| CVE-2019-14946 | The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. | medium | 5.4 | <2.0.52 | 2.0.52 |
| CVE-2022-1209 | The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social | medium | 4.3 | <=2.3.1 | – |
| CVE-2018-10233 | The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. T | high | 8.8 | <2.0.7 | 2.0.7 |
| CVE-2021-24306 | The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, v | medium | 5.4 | <2.1.20 | 2.1.20 |
| CVE-2018-10234 | Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Cust | medium | 4.8 | <2.0.11 | 2.0.11 |
| CVE-2024-10528 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 4.3 | <2.9.0 | 2.9.0 |
| CVE-2025-0308 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | high | 7.5 | <2.9.2 | 2.9.2 |
| CVE-2024-2765 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.4 | <2.8.5 | 2.8.5 |
| CVE-2024-8519 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 6.4 | <2.8.7 | 2.8.7 |
| CVE-2024-12276 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | <2.10.0 | 2.10.0 |
| CVE-2025-0318 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | <2.9.2 | 2.9.2 |
| CVE-2024-8520 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v | medium | 5.3 | <2.8.7 | 2.8.7 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked