PT-2026-95757

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.1 Description An issue exists where the plugin fails to escape a value derived from user-supplied profile names before outputting it in the page title. Additionally, the software decodes...

CVE-2026-19423: Improper Privilege Management

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

PT-2017-7403

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 1.3.29 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the refer parameter to...

WordPress Ultimate Member 1.3.28 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: Ultimate Member WordPress plugin Vendor: Ultimate Member Vulnerable Versions: 1.3.28 and probably prior Tested Version: 1.3.28 Advisory Publication: October 29, 2015 without technical details Vendor Notification: October 29, 2015 Vend...