CVE-2026-96451

The Ultimate Member WordPress plugin, versions through 2.13.1 , is vulnerable to a Privilege Escalation issue due to an Authorization Bypass Through User-Controlled Key (CWE-639). This vulnerability allows an attacker to escalate privileges within the system. While specific exploit code and a dir...

EUVD-2026-92042

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

Ultimate-Social-Scrapers

Лучшие социальные скраперы от Cyfy Labs 📢 Важное обновление 📢 Cyfy Labs больше не активен. Спасибо за вашу поддержку на этом пути! 🫶 Cyfy Labs предоставляет современные инструменты для скрапинга социальных сетей. Наши продукты позволяют компаниям и исследователям собирать сотни публичных точек...

nginx-ultimate-bad-bot-blocker

REPO| BECOME A SPONSOR ---|--- | Your logo and link to your domain will appear here if you become a sponsor. Simply email me on [email protected] if you would like to sponsor this project as South Africa is not supported yet under the Github sponsor program. | Help Support Me at...

CVE-2023-3460

Ultimate Member - Aperçu Bienvenue dans le dépôt GitHub d'Ultimate Member ! Ultimate Member est un plugin de profils utilisateur et d'adhésion puissant et flexible pour WordPress. Cependant, les plugins peuvent parfois présenter des vulnérabilités et entraîner une compromission du site. Avis...

CVE-2024-8425

Wordpress WooCommerce Ultimate Gift Card = 2.6.0 - Неаутентифицированная произвольная загрузка файлов CVE-2024-8425 Плагин WooCommerce Ultimate Gift Card для WordPress уязвим к произвольной загрузке файлов из-за недостаточной проверки типа файлов в функциях 'mwbwgmpreviewmail' и...

CVE-2024-1071

CVE-2024-1071 Ultimate Member Accès non autorisé à la base de données / SQLi Le PoC est maintenant publié. Il a été créé uniquement à des fins éducatives/de recherche ! Utilisez-le à vos risques et périls !...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Ultimate Member versions = 2.13.1...

react2shell-ultimate

React2Shell Ultimate Scanner v2.0 Scanner professionnel de vulnérabilité RSC RCE pour Next.js – CVE-2025-66478 🎯 Aperçu React2Shell Ultimate est un scanner de vulnérabilité complet pour la CVE-2025-66478 – une vulnérabilité critique d’exécution de code à distance RCE affectant les applications...

WordPress WP Ultimate Review plugin <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Eunho Kim in WordPress Plugin Wp Ultimate Review versions = 2.4.3...

Dependency Scanning

Composant pour l'analyse des dépendances et des licences Ce composant génère un CycloneDX Software Bill of Materials BOM, qui est utilisé par GitLab pour identifier les dépendances d'un projet et leurs licences. Ce CycloneDX Software Bill of Materials est compatible avec la taxonomie GitLab. De...

CVE-2026-103519

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100157

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

EUVD-2026-91965

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-100157

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.4.3 . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. Specifically, the xs_reviw_summery parameter is ...

CVE-2026-100157 WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode)

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519

The WP Ultimate Review plugin for WordPress (all versions up to and including 2.4.3 ) is vulnerable to arbitrary shortcode execution . The root cause is a failure to properly validate input before passing it to the do_shortcode function. Authenticated attackers with subscriber-level access or hig...

EUVD-2026-91959

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-103519 WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...