CVE-2026-19251

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

WordPress Ultimate Member plugin < 2.13.0 - Unauthenticated Unapproved Comment Disclosure vulnerability

Unauthenticated Unapproved Comment Disclosure vulnerability discovered by Alessandro Greco aka Aleff, Giovambattista Ianni University of Calabria - UNICAL in WordPress Plugin Ultimate Member versions 2.13.0...

EUVD-2026-69864

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-19251

The Ultimate Member WordPress plugin versions before 2.13.0 is vulnerable to an unauthenticated information disclosure. The root cause is a failure to verify if a comment has been approved or if the associated profile is private before returning profile activity to unauthenticated visitors. This ...

CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

EUVD-2025-210823

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

PT-2026-84698

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...

PT-2026-84610

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-84760: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...

CVE-2026-19251: Exposure of Sensitive Information to an Unauthorized Actor

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2025-15664: Improper Neutralization of Input During Web Page Generation

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15663: Improper Neutralization of Input During Web Page Generation

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2026-78077

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in MegaMenu Layout Container & Embed Inputs in Helix Ultimate 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection...

CVE-2026-78079

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78078

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification an...

CVE-2026-78076

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...

CVE-2026-78075

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

CVE-2026-78075

Helix Ultimate is a Joomla extension by joomshaper.com. Versions prior to 2.2.10 contain a Broken Object-Level Authorization flaw in the Blog::remove_image() function. The function verified that the user was authorized to edit the article ID supplied in the request, but did not confirm that the s...

CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...