CVE-2026-96539

The Ultimate Member WordPress plugin (versions

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import. id: CVE-2019-17232 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated Options Import and Export author: daffainfo severity: high description: |...

CVE-2026-105886 WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5...

WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin Ultimate Post Kit versions = 4.5.5...

WordPress Ultimate Multisite plugin < 2.17.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions 2.17.0...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure vulnerability discovered by Mutantgun in WordPress Plugin Ultimate Member versions = 2.13.1...

CVE-2026-102397

The WordPress Ultimate Maps by Supsystic plugin, version 1.5.5 and below , is affected by an unauthenticated Broken Access Control vulnerability. While the vulnerability allows for unauthorized access, the provided documents do not specify the exact component, root cause, or practical consequence...

CVE-2026-102397 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-102396

The Ultimate Maps by Supsystic WordPress plugin (versions

CVE-2026-96833 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Ultimate Maps by Supsystic versions = 1.5.5...

CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

CVE-2026-94391 WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

CVE-2026-94391 WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.11.4 - Authenticated (Contributor+) Account Takeover vulnerability

Authenticated Contributor+ Account Takeover vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.11.4...

CVE-2019-25763: Authentication Bypass Using an Alternate Path or Channel

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the...

CVE-2016-20075: Incorrect Authorization

WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the...

CVE-2018-25352

The CVE-2018-25352 entry concerns the WordPress plugin Ultimate Form Builder Lite (version 1.3.7 and earlier). The vulnerability is a SQL injection in the entry_id parameter, exploitable via POST to admin-ajax.php with the ufbl_get_entry_detail_action action. Authenticated attackers can manipulat...