Ultimatemember vulnerabilities
We track 13 vulnerabilities in Ultimatemember products across 10 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2026.
Latest Ultimatemember vulnerabilities
- 7.2 High severity
Ultimate Member – User Profile, Registration…: Improper Neutralization of Input During Web Page Generation
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to
- 7.5 High severity
Ultimate Member – User Profile, Registration…: Missing Authorization
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly ve
- 7.5 High severity
Ultimate Member – User Profile, Registration…: Improper Neutralization of Special Elements used in an SQL Command
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficie
- 8.8 High severity
Ultimate Member – User Profile, Registration…: Missing Authorization
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allow
- 8.0 High severity
Ultimate Member – User Profile, Registration…: Improper Authorization
The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[um_loggedin]'
- 7.5 High severity
Ultimate Member – User Profile, Registration…: Improper Neutralization of Special Elements used in an SQL Command
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to ins
- 7.5 High severity
Ultimate Member – User Profile, Registration…: Improper Neutralization of Special Elements used in an SQL Command
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search parameter in all versions up to, and including, 2.9.1 due to insuff
- 8.8 High severity
JobBoardWP – Job Board Listings and Submissions: Missing Authorization
Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.2
- 8.8 High severity
ForumWP – Forum & Discussion Board: Authorization Bypass Through User-Controlled Key
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' use
- 9.8 Critical severity
Ultimate Member – User Profile, Registration…: Improper Neutralization of Special Elements used in an SQL Command
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the us
- 7.2 High severity
Ultimate Member – User Profile, Registration…: Improper Control of Generation of Code
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to no
- 7.2 High severity
Ultimate Member – User Profile, Registration…: Improper Control of Generation of Code
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possi
- 7.5 High severity
Ultimate Member Plugin: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the file includes/core/class-shortcodes.php of the component Template Handler. The manipulation of the arg