CVE-2019-10270

Affected software: WordPress Ultimate Member plugin. Vulnerable component: password reset flow in Ultimate Member (versions around 2.39; OpenVAS references

CVE-2024-1071

Summary: CVE-2024-1071 affects WordPress via the Ultimate Member plugin, versions 2.1.3–2.8.2, with a SQL injection in the sorting parameter due to insufficient escaping and unprepared queries. This allows unauthenticated attackers to append or inject SQL to extract data from the database; impact...

CVE-2023-3460

CVE-2023-3460 affects the WordPress plugin Ultimate Member prior to version 2.6.7. The vulnerability allows unauthenticated attackers to create user accounts with arbitrary capabilities, effectively enabling privilege escalation to Administrator via manipulation of wp_capabilities during registra...

CVE-2025-0308

The CVE covers WordPress plugin Ultimate Member (versions up to 2.9.1) with a time-based SQL Injection via the search parameter caused by insufficient escaping and lack of proper query preparation, enabling unauthenticated attackers to append SQL to existing queries to extract data. Some connecte...

CVE-2022-1208

The CVE-2022-1208 entry concerns the WordPress Ultimate Member plugin. A stored cross-site scripting (XSS) flaw exists in the Biography field on individual user profile pages due to insufficient input sanitization and output escaping, allowing HTML-encoded scripts to be reflected on the page. Aff...

CVE-2019-10271

The CVE-2019-10271 entry corresponds to a vulnerability in the WordPress Ultimate Member plugin (version 2.39) that allows unauthorized modification of profile and cover pictures. The underlying issue enables an authenticated attacker to modify the profile and cover images of any user, including ...

CVE-2022-3383

The CVE-2022-3383 entry refers to the WordPress Ultimate Member plugin. Affected ecosystem: WordPress with the Ultimate Member plugin (versions up to 2.5.0). Root cause: the get_option_value_from_callback function accepts user-supplied input and passes it through call_user_func(), enabling an aut...

CVE-2022-1209

The CVE concerns the WordPress plugin Ultimate Member, vulnerable up to version 2.3.1 due to insufficient validation of URLs in the social fields on the Profile Page, enabling arbitrary redirects. Affected component: Ultimate Member plugin for WordPress; root cause: open redirect caused by improp...

CVE-2025-0318

The CVE-2025-0318 entry concerns the WordPress plugin Ultimate Member (versions up to and including 2.9.1). According to connected records, the vulnerability is an Information Exposure flaw that allows unauthenticated attackers to exfiltrate data from the wp_usermeta table due to differing error ...

CVE-2020-36155

CVE-2020-36155 affects the WordPress plugin Ultimate Member (versions prior to 2.1.12). The vulnerability arises when registration data is passed to the plugin’s update_profile function, allowing an attacker to submit metadata (e.g., wp_capabilities[administrator]) that gets accepted, enabling un...

CVE-2020-6859

The CVE-2020-6859 entry corresponds to multiple Insecure Direct Object Reference (IDOR) vulnerabilities in the WordPress Ultimate Member plugin (affected until version 2.1.2) in includes/core/class-files.php. The underlying issue allows remote attackers to modify other users’ profiles and cover p...

CVE-2024-2123

CVE-2024-2123 : The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is affected by a Stored Cross‑Site Scripting (XSS) in multiple parameters due to insufficient input sanitization and output escaping in versions up to 2...

CVE-2024-2765

The CVE refers to the Ultimate Member plugin for WordPress. It is a Stored XSS vulnerability via Skype/Spotify URL parameters in versions

CVE-2022-3361

The CVE-2022-3361 entry concerns the WordPress Ultimate Member plugin (versions up to 2.5.0). The vulnerability is a directory traversal flaw caused by insufficient validation of the template attribute in shortcodes, allowing an attacker with administrative privileges to supply traversal sequence...

CVE-2022-3384

The WordPress Ultimate Member plugin (up to version 2.5.0) is vulnerable to remote code execution via the populate_dropdown_options function, which passes user input to call_user_func() and is restricted to non-parameter PHP functions. An authenticated administrator can execute arbitrary code on ...

CVE-2019-10673

CVE-2019-10673 affects the WordPress plugin “Ultimate Member” (versions before 2.0.40). A CSRF flaw in the logged-in user profile edit form lets an attacker elevate privileges by changing the admin email, then reset the admin password via WordPress password‑reset, enabling sensitive data access a...

CVE-2024-12276

The CVE-2024-12276 entry concerns the WordPress plugin “Ultimate Member” (versions up to and including 2.9.2). The vulnerability is a second‑order SQL Injection via filenames caused by insufficient escaping of user‑supplied parameters and inadequate preparation of the existing SQL query. Exploita...

CVE-2015-9304

The CVE-2015-9304 affects the WordPress plugin Ultimate Member prior to version 1.3.18. It is described as a cross-site scripting (XSS) vulnerability that is triggered via text input, allowing an attacker to inject client-side script. The root cause is improper handling/validation of user-supplie...

CVE-2020-36157

The CVE-2020-36157 entry concerns the WordPress plugin Ultimate Member (before 2.1.12). The issue is an unauthenticated privilege escalation via the role parameter during user registration, caused by insufficient filtering that allows an attacker to supply a WordPress capability (or custom Ultima...

CVE-2020-36156

CVE-2020-36156 affects the WordPress plugin Ultimate Member (before 2.1.12). The vulnerability allows an authenticated user with wp-admin access to profile.php to supply the parameter um-role with a value (e.g., Administrator) during a profile update, escalating privileges. Documented impact is P...

CVE-2024-10528

CVE-2024-10528 (Ultimate Member) affects WordPress plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership. The root cause is a missing capability check in the image resize handlers (wp_ajax_um_resize_image() and ajax_resize_image()), which a...

CVE-2021-24306

The vulnerability CVE-2021-24306 affects the WordPress plugin Ultimate Member – User Profile, User Registration, Login & Membership, before version 2.1.20. The root cause is inadequate sanitization/validation/encoding of the query string when generating a link to edit a user’s own profile, enabli...

CVE-2015-8354

CVE-2015-8354 affects the WordPress Ultimate Member plugin (versions prior to 1.3.29). The root cause is lack of input filtering for the _refer parameter in wp-admin/users.php when update=confirm_delete, enabling an unauthenticated attacker to craft a link that executes arbitrary HTML/script in t...

CVE-2019-14945

The CVE-2019-14945 issue affects the WordPress Ultimate Member plugin prior to version 2.0.54, with a cross-site scripting (XSS) vulnerability stemming from insufficient validation of client-side data. Multiple sources confirm the vulnerability and its presence in versions before 2.0.54; patches/...

CVE-2024-8520

CVE-2024-8520 concerns the WordPress plugin Ultimate Member (versions ≤ 2.8.6). The vulnerability is a Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on admin_init or user_action_hook, enabling unauthenticated attackers to change a user’s membership status by trick...

CVE-2022-3966

CVE-2022-3966 affects the WordPress plugin Ultimate Member components up to version 2.5.0. The vulnerability is in the Template Handler’s function load_template (file: includes/core/class-shortcodes.php) where manipulating the tpl argument enables pathname traversal. The issue can be exploited re...

CVE-2019-14946

CVE-2019-14946 affects the WordPress plugin Ultimate Member (before 2.0.52). It is an XSS vulnerability in UM Roles create/edit operations. Related sources also describe a CSRF alongside stored XSS; a fix was released in v2.0.52 to address these issues.

CVE-2018-0585

CVE-2018-0585 is a cross-site scripting vulnerability in the WordPress

CVE-2019-14947

The CVE-2019-14947 entry concerns the WordPress plugin Ultimate Member (pre-2.0.52). The vulnerability is an XSS weakness triggered during an account upgrade, affecting the plugin’s handling of user input. Public references in the connected documents confirm the affected software and the nature o...

CVE-2018-17866

CVE-2018-17866 affects the WordPress plugin Ultimate Member – User Profile & Membership (vendor/product: Ultimate Member, affected version

CVE-2018-6944

CVE-2018-6944 affects the WordPress plugin UltimateMember (version 2.0) where core/lib/upload/um-file-upload.php is vulnerable to cross-site scripting due to improper sanitization of input assigned to the $temp variable. This XSS vulnerability could allow injected JavaScript to be executed in the...

CVE-2020-36170

CVE-2020-36170 affects the WordPress Ultimate Member plugin, with versions prior to 2.1.13 exposed to a vulnerability where hidden name="timestamp" fields in forms are mishandled. The issue is documented across multiple feeds (NVD/Red Hat/CNVD) and is characterized by a lack of public exploitatio...

CVE-2024-8519

CVE-2024-8519 affects the Ultimate Member WordPress plugin (versions up to and including 2.8.6). It is a Stored Cross-Site Scripting (XSS) vulnerability in the um_loggedin shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attac...

CVE-2018-13136

CVE-2018-13136 affects the WordPress plugin Ultimate Member (aka ultimatemember) for versions prior to 2.0.18, exposing a cross-site scripting (XSS) vulnerability via the wp-admin settings screen. The issue is documented across multiple sources (CNVD/EUVD/OpenVAS/NVD/CVE records) as an XSS in thi...

CVE-2018-20965

CVE-2018-20965 affects the WordPress plugin Ultimate Member (versions prior to 2.0.4). The connected documents confirm a Cross-Site Scripting (XSS) vulnerability in that plugin, caused by inadequate validation of client-side data. Impact stated across sources is XSS with no explicit exploitation ...

CVE-2016-10872

CVE-2016-10872 pertains to the WordPress plugin Ultimate Member (prior to version 1.3.40). The vulnerability is a cross-site scripting (XSS) flaw found on the login form, arising in the affected plugin’s handling of user-supplied data. Connected sources consistently describe the same issue and in...

CVE-2023-31216

CVE-2023-31216 affects the WordPress Ultimate Member plugin up to version 2.6.0 and is a Cross-Site Request Forgery (CSRF) vulnerability. The NVD entry lists a high impact (CVSSv3.1: 8.8 HIGH) affecting confidentiality, integrity, and availability, while Patchstack and related sources describe a ...