# Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

> Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:29 UTC.

## Facts (WordPress.org)

- Slug: `ultimate-member`
- Author: Ultimate Member
- Version: 2.14.2
- Active installs: 200,000+
- Last update: 2026-11-02 (11 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.2, PHP 7.0
- Tags: community, member, membership, user profile, User Registration
- Page: https://wordpress.org/plugins/ultimate-member/

## Checks (against WordPress 7.1.4)

- OK: Updated 11 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Clashes ↔ Plays well, Locked in ↔ Portable, Cluttered ↔ Clean, Slow ↔ Responsive, Phones home ↔ Private, Steep ↔ Easy.

## Known vulnerabilities

- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field (up to 2.14.1). CVE-2026-116621, https://www.wordfence.com/threat-intel/vulnerabilities/id/50b7a6e0-3c25-4eda-acbd-43643a291bca?source=api-prod
- 2026-10-28 HIGH: Unauthenticated PHP Object Injection (up to 2.13.1). CVE-2026-115968, https://www.wordfence.com/threat-intel/vulnerabilities/id/c52628cc-d7c5-4e63-9a78-1c69c9aa1078?source=api-prod
- 2026-10-28 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field (up to 2.14.0). CVE-2026-107625, https://www.wordfence.com/threat-intel/vulnerabilities/id/8180160d-ba33-4f79-baa5-2613be470b0f?source=api-prod
- 2026-10-09 HIGH: Unauthenticated Privilege Escalation (up to 2.13.1). CVE-2026-96539, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d4b53bd-d684-45d6-9924-e3e2d203ef03?source=api-prod
- 2026-10-03 MEDIUM: Authenticated (Subscriber+) Privilege Escalation (up to 2.13.1). CVE-2026-96451, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b10dde5-dfb9-4bff-9d78-042ae3e73bba?source=api-prod
- 2026-10-03 HIGH: Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass (up to 2.13.1). CVE-2026-93428, https://www.wordfence.com/threat-intel/vulnerabilities/id/cde81421-e080-4530-87a5-6515f1c9800b?source=api-prod
- 2026-10-03 HIGH: Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter (up to 2.13.1). CVE-2026-96270, https://www.wordfence.com/threat-intel/vulnerabilities/id/5673f2b9-1c30-4ce0-8a8c-7580d0346cb9?source=api-prod
- 2026-10-01 MEDIUM: Authenticated (Administrator+) SQL Injection (up to 2.13.1). CVE-2026-62059, https://www.wordfence.com/threat-intel/vulnerabilities/id/97818871-a27f-4d16-bdef-230f6324d886?source=api-prod
- 2026-09-19 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.13.0). CVE-2026-85680, https://www.wordfence.com/threat-intel/vulnerabilities/id/43c44e1a-3b53-44e9-8233-2a4dbea4fa12?source=api-prod
- 2026-09-02 MEDIUM: Unauthenticated Unapproved Comment and Private Profile Data Disclosure (before 2.13.0). CVE-2026-19251, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b3a10e-da2b-4694-85af-54fd7a8c25c1?source=api-prod
- 2026-08-28 HIGH: Unauthenticated Privilege Escalation (2.6.7 to 2.12.1). CVE-2026-19423, https://www.wordfence.com/threat-intel/vulnerabilities/id/d518f02a-073d-4eb8-8b9d-0a2ff815b0f3?source=api-prod
- 2026-08-25 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) (up to 2.12.1). CVE-2026-18547, https://www.wordfence.com/threat-intel/vulnerabilities/id/a7961bcc-eae7-40e1-8838-9755c7655500?source=api-prod
- 2026-07-31 HIGH: Unauthenticated Privilege Escalation (before 2.12.1). CVE-2026-12251, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae3cf36-ca3a-4f6d-90c3-6fb67c6862b9?source=api-prod
- 2026-07-10 HIGH: Unauthenticated Blind SQL Injection (up to 2.10.1). CVE-2026-15290, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f539e25-5483-417d-a3c5-e7034c03c673?source=api-prod
- 2026-07-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 2.11.0). CVE-2026-11766, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ecf826d-cdb9-4a6e-b97f-38992c5ece85?source=api-prod
- 2026-07-03 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field (up to 2.11.4). CVE-2026-8489, https://www.wordfence.com/threat-intel/vulnerabilities/id/229a4e61-571c-44c6-9972-4dfc743afffe?source=api-prod
- 2026-06-24 HIGH: Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure (up to 2.11.4). CVE-2026-7761, https://www.wordfence.com/threat-intel/vulnerabilities/id/9aff7b03-4f03-434c-be87-b10ceeb4e625?source=api-prod
- 2026-04-03 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets (up to 2.11.1). CVE-2025-15064, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=api-prod
- 2026-03-27 HIGH: Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag (up to 2.11.2). CVE-2026-4248, https://www.wordfence.com/threat-intel/vulnerabilities/id/baafd001-144d-4ee4-b7e6-28c0931e6e10?source=api-prod
- 2026-02-17 MEDIUM: Reflected Cross-Site Scripting via Filter Parameters (up to 2.11.1). CVE-2026-1404, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=api-prod
- 2025-12-20 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (up to 2.11.0). CVE-2025-13220, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c06548-238d-4b75-8f20-d7de6fc21539?source=api-prod
- 2025-12-19 MEDIUM: Unauthenticated Sensitive Information Exposure (up to 2.11.0). CVE-2025-12492, https://www.wordfence.com/threat-intel/vulnerabilities/id/61337d2d-d15a-45f2-b730-fc034eb3cd31?source=api-prod
- 2025-12-16 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' (up to 2.11.0). CVE-2025-13217, https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=api-prod
- 2025-12-16 MEDIUM: Authenticated (Subscriber+) Profile Privacy Setting Bypass (up to 2.11.0). CVE-2025-14081, https://www.wordfence.com/threat-intel/vulnerabilities/id/aad57a68-c385-491f-a5a2-32906df4b52b?source=api-prod
- 2025-05-07 HIGH: Authenticated (Administrator+) Arbitrary Function Call (up to 2.10.3). CVE-2025-47691, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc8b33c7-23ef-4b5c-bdb9-b4e548d18832?source=api-prod
- 2025-03-04 HIGH: Unauthenticated SQL Injection via search Parameter (up to 2.10.0). CVE-2025-1702, https://www.wordfence.com/threat-intel/vulnerabilities/id/34adbae5-d615-4f8d-a845-6741d897f06c?source=api-prod
- 2025-02-20 MEDIUM: Authenticated SQL Injection (up to 2.9.2). CVE-2024-12276, https://www.wordfence.com/threat-intel/vulnerabilities/id/846f9828-2f1f-4d08-abfb-909b8d634d8a?source=api-prod
- 2025-01-17 MEDIUM: Information Exposure (up to 2.9.1). CVE-2025-0318, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ee149bf-ffa3-4906-8be2-9c3c40b28287?source=api-prod
- 2025-01-17 HIGH: Unauthenticated SQL Injection (up to 2.9.1). CVE-2025-0308, https://www.wordfence.com/threat-intel/vulnerabilities/id/e3e5bb98-2652-499a-b8cd-4ebfe1c1d890?source=api-prod
- 2024-11-20 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update (up to 2.8.9). CVE-2024-10528, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a9793b6-2186-46ef-b204-d8f8f154ebf3?source=api-prod
- 2024-10-03 MEDIUM: Cross-Site Request Forgery to Membership Status Change (up to 2.8.6). CVE-2024-8520, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=api-prod
- 2024-10-03 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 2.8.6). CVE-2024-8519, https://www.wordfence.com/threat-intel/vulnerabilities/id/9e394bb2-d505-4bf1-b672-fea3504bf936?source=api-prod
- 2024-04-10 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 2.8.4). CVE-2024-2765, https://www.wordfence.com/threat-intel/vulnerabilities/id/86ddd5fd-137b-478e-952e-b36fc6a5c28d?source=api-prod
- 2024-03-08 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 2.8.3). CVE-2024-2123, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8bc1653-8fee-468a-bb6d-f24959846ee5?source=api-prod
- 2024-02-23 CRITICAL: Unauthenticated SQL Injection (2.1.3 to 2.8.2). CVE-2024-1071, https://www.wordfence.com/threat-intel/vulnerabilities/id/005fa621-3c49-4c23-add5-d6b7a9110055?source=api-prod
- 2023-08-08 MEDIUM: Cross-Site Request Forgery (up to 2.6.8). WF-f5b08a10-f6bc-44a0-865a-5ad71a1772f7, https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b08a10-f6bc-44a0-865a-5ad71a1772f7?source=api-prod
- 2023-06-29 CRITICAL: Privilege Escalation via Arbitrary User Meta Updates (up to 2.6.6). CVE-2023-3460, https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0e763e-f03e-41fb-8c6c-4de5d3acae00?source=api-prod
- 2023-05-30 MEDIUM: Cross-Site Request Forgery to Form Duplication (up to 2.6.0). CVE-2023-31216, https://www.wordfence.com/threat-intel/vulnerabilities/id/97ced4ed-915b-4234-b59d-75db983f90e8?source=api-prod
- 2022-10-28 MEDIUM: Authenticated (Admin+) Directory Traversal (1.0 to 2.5.0). CVE-2022-2445, https://www.wordfence.com/threat-intel/vulnerabilities/id/04cd8da4-9da3-4c80-a77e-c2f792391593?source=api-prod
- 2022-10-28 MEDIUM: Authenticated (Contributor+) Directory Traversal via Shortcodes (up to 2.5.0). CVE-2022-3361, https://www.wordfence.com/threat-intel/vulnerabilities/id/8c7d5fbe-d272-46d4-9b33-889ba77dcc52?source=api-prod
- 2022-10-28 HIGH: Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options (up to 2.5.0). CVE-2022-3384, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdcdbba7-8280-457b-a511-66a486978a31?source=api-prod
- 2022-10-28 HIGH: Authenticated (Admin+) Remote Code Execution via Multi-Select (up to 2.5.0). CVE-2022-3383, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed28fe16-0835-4e94-a30e-305e7ba03740?source=api-prod
- 2022-07-15 MEDIUM: Subscriber+ Stored Cross-Site Scripting (2.4.0 to 2.4.0). WF-45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a, https://www.wordfence.com/threat-intel/vulnerabilities/id/45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a?source=api-prod
- 2022-07-14 HIGH: Username Enumeration (up to 2.4.1). WF-f4832fbb-94ed-41c4-8434-1972f4d92476, https://www.wordfence.com/threat-intel/vulnerabilities/id/f4832fbb-94ed-41c4-8434-1972f4d92476?source=api-prod
- 2022-04-29 MEDIUM: Arbitrary Redirect (up to 2.3.1). CVE-2022-1209, https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=api-prod
- 2022-03-21 MEDIUM: Stored Cross-Site Scripting (up to 2.3.2). CVE-2022-1208, https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=api-prod
- 2021-05-07 MEDIUM: Reflected Cross-Site Scripting (before 2.1.20). CVE-2021-24306, https://www.wordfence.com/threat-intel/vulnerabilities/id/c340b7c0-35ab-4707-a999-261a721a9a37?source=api-prod
- 2020-12-09 MEDIUM: Cross-Site Scripting (before 2.1.13). CVE-2020-36170, https://www.wordfence.com/threat-intel/vulnerabilities/id/bd46a2c3-f24d-4dff-b899-a95acb6310f7?source=api-prod
- 2020-11-09 CRITICAL: Unauthenticated Privilege Escalation via User Roles (before 2.1.12). CVE-2020-36157, https://www.wordfence.com/threat-intel/vulnerabilities/id/1081eeb1-3240-478d-8679-7bf9293b5a95?source=api-prod
- 2020-11-09 CRITICAL: Unauthenticated Privilege Escalation via User Meta (before 2.1.12). CVE-2020-36155, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2ac5c8-9e76-40b8-a2a4-8cb4291871f2?source=api-prod
- 2020-11-09 CRITICAL: Authenticated Privilege Escalation via Profile Update (before 2.1.12). CVE-2020-36156, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3805936-675e-474f-a3f7-acea69bd72f0?source=api-prod
- 2020-07-23 MEDIUM: Open Redirect (before 2.1.7). WF-db3b206d-16c5-48fb-800d-d017a0c76630, https://www.wordfence.com/threat-intel/vulnerabilities/id/db3b206d-16c5-48fb-800d-d017a0c76630?source=api-prod
- 2020-01-13 MEDIUM: Insecure Direct Object Reference (before 2.1.3). CVE-2020-6859, https://www.wordfence.com/threat-intel/vulnerabilities/id/65a0033d-2266-429c-aab2-80bd46c93b91?source=api-prod
- 2019-08-12 MEDIUM: Cross Site Scripting (up to 1.3.88). CVE-2018-0585, https://www.wordfence.com/threat-intel/vulnerabilities/id/0549acd5-686b-4505-af68-f3f854096f63?source=api-prod
- 2019-08-12 MEDIUM: Authenticated Unrestricted File Upload (before 2.0.4). CVE-2018-0587, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc2af96c-09c5-4ddf-a910-04291aeeef49?source=api-prod
- 2019-08-12 MEDIUM: Directory Traversal (before 2.0.4). CVE-2018-0586, https://www.wordfence.com/threat-intel/vulnerabilities/id/f24cfefe-f671-456d-a378-44a41fc81c0e?source=api-prod
- 2019-08-12 MEDIUM: Cross Site Scripting (up to 2.0.3). CVE-2018-20965, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b6c62f-b53f-44f7-8fe2-22bac0074f9d?source=api-prod
- 2019-07-22 MEDIUM: Cross-Site Scripting (up to 2.0.53). CVE-2019-14945, https://www.wordfence.com/threat-intel/vulnerabilities/id/6eedf009-116c-4a98-8b84-e01bd35e7e60?source=api-prod
- 2019-06-24 MEDIUM: Cross-Site Request Forgery and Stored Cross-Site Scripting (up to 2.0.51). CVE-2019-14947, https://www.wordfence.com/threat-intel/vulnerabilities/id/acbe1c36-04e7-49af-90fa-d8acbe351b57?source=api-prod
- 2019-06-24 MEDIUM: Cross-Site Request Forgery and Stored Cross-Site Scripting (up to 2.0.51). CVE-2019-14946, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf238e9d-be91-4c9a-8506-ee01927f5173?source=api-prod
- 2019-06-15 MEDIUM: Unauthorized Profile Modification (up to 2.0.39). CVE-2019-10271, https://www.wordfence.com/threat-intel/vulnerabilities/id/00b4b903-4682-458b-9681-751179460b75?source=api-prod
- 2019-06-15 HIGH: Privilege Escalation (up to 2.0.39). CVE-2019-10270, https://www.wordfence.com/threat-intel/vulnerabilities/id/e556d8c9-3ca5-4bec-a840-7a6d67532e59?source=api-prod
- 2019-05-13 MEDIUM: Admin+ Stored Cross-Site Scripting (before 2.0.46). WF-4890ec6f-ba73-48bd-8dd7-f896d6b4a140, https://www.wordfence.com/threat-intel/vulnerabilities/id/4890ec6f-ba73-48bd-8dd7-f896d6b4a140?source=api-prod
- 2019-05-13 CRITICAL: Arbitrary File Deletion/Read (up to 2.0.45). WF-618f644b-a92c-4f7f-aaea-c03ee7d6e0f9, https://www.wordfence.com/threat-intel/vulnerabilities/id/618f644b-a92c-4f7f-aaea-c03ee7d6e0f9?source=api-prod
- 2019-05-13 MEDIUM: Low-Privileged Stored Cross-Site Scripting (up to 2.0.45). WF-d0c0562f-1f3b-4630-bbc5-4ea2985d71d1, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0c0562f-1f3b-4630-bbc5-4ea2985d71d1?source=api-prod
- 2019-04-01 HIGH: Cross-Site Request Forgery (before 2.0.40). CVE-2019-10673, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa0881ab-d731-4e57-8323-c49b9306bf50?source=api-prod
- 2018-11-27 MEDIUM: Cross-Site Request Forgery (up to 2.0.32). WF-a2e1948a-9513-43e4-aadd-369a7f4dc137, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e1948a-9513-43e4-aadd-369a7f4dc137?source=api-prod
- 2018-10-06 MEDIUM: Multiple Cross-Site Scripting vulnerabilities (up to 2.0.27). CVE-2018-17866, https://www.wordfence.com/threat-intel/vulnerabilities/id/baab325d-58c2-446b-af70-6951eeef3bb1?source=api-prod
- 2018-08-09 MEDIUM: Cross-Site Scripting (before 2.0.22). WF-b1be1928-a278-48d5-beb2-00e3c8df3fa9, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1be1928-a278-48d5-beb2-00e3c8df3fa9?source=api-prod
- 2018-08-08 HIGH: Arbitrary File Upload (before 2.0.22). WF-5143a2d2-504a-46b8-b82b-19beba4da64d, https://www.wordfence.com/threat-intel/vulnerabilities/id/5143a2d2-504a-46b8-b82b-19beba4da64d?source=api-prod
- 2018-07-03 MEDIUM: Authenticated Cross-Site Scripting (up to 2.0.17). CVE-2018-13136, https://www.wordfence.com/threat-intel/vulnerabilities/id/561c8bcf-30b0-4ee6-b507-4cacf22c1e58?source=api-prod
- 2018-05-14 MEDIUM: Improper Access Control (up to 2.0.3). CVE-2018-0589, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3221af7-13ea-4c90-b2ca-75eb3d373ed3?source=api-prod
- 2018-05-10 MEDIUM: Insecure Direct Object Reference (before 2.0.4). CVE-2018-0590, https://www.wordfence.com/threat-intel/vulnerabilities/id/13033a3c-f020-4821-a7ad-bfcfca407df0?source=api-prod
- 2018-05-10 MEDIUM: Directory Traversal (up to 2.0.39). CVE-2018-0588, https://www.wordfence.com/threat-intel/vulnerabilities/id/3cec3799-cf44-412b-8590-b8fc60c58535?source=api-prod
- 2018-04-23 MEDIUM: Authenticated Cross-Site Scripting (before 2.0.11). CVE-2018-10234, https://www.wordfence.com/threat-intel/vulnerabilities/id/244a23a2-8899-4ab4-8f8d-62756e4ea56b?source=api-prod
- 2018-04-23 HIGH: Multiple Cross-Site Request Forgery Issues (before 2.0.7). CVE-2018-10233, https://www.wordfence.com/threat-intel/vulnerabilities/id/9742a4d0-34b0-4f7f-aa2b-a6f7cb6aacd4?source=api-prod
- 2018-02-14 MEDIUM: Cross-Site Scripting (before 2.0.4). CVE-2018-6943, https://www.wordfence.com/threat-intel/vulnerabilities/id/43b5a321-c82e-4d0b-9def-b74c3cf439d3?source=api-prod
- 2018-02-14 MEDIUM: Cross-Site Scripting (up to 2.0). CVE-2018-6944, https://www.wordfence.com/threat-intel/vulnerabilities/id/b7162b78-65b7-4f80-83f0-47d9afc2ed65?source=api-prod
- 2017-04-17 CRITICAL: Shortcode Injection (up to 1.3.83). WF-bab67a5c-3390-4423-8fa9-b5ffbc98324d, https://www.wordfence.com/threat-intel/vulnerabilities/id/bab67a5c-3390-4423-8fa9-b5ffbc98324d?source=api-prod
- 2016-12-06 CRITICAL: Missing Authorization to Password Reset (up to 1.3.75). WF-8911642f-6061-42a1-b733-8cc44b2870f1, https://www.wordfence.com/threat-intel/vulnerabilities/id/8911642f-6061-42a1-b733-8cc44b2870f1?source=api-prod
- 2016-07-10 CRITICAL: Local File Inclusion (before 1.3.65). WF-cc046b72-692a-4980-90ad-26c8fc2a131a, https://www.wordfence.com/threat-intel/vulnerabilities/id/cc046b72-692a-4980-90ad-26c8fc2a131a?source=api-prod
- 2016-04-06 MEDIUM: Cross-Site Scripting (before 1.3.40). CVE-2016-10872, https://www.wordfence.com/threat-intel/vulnerabilities/id/a8d4dc12-ae17-477f-a8d2-da9747672a26?source=api-prod
- 2015-12-02 MEDIUM: Reflected Cross-Site Scripting (before 1.3.29). CVE-2015-8354, https://www.wordfence.com/threat-intel/vulnerabilities/id/97fd7952-a7f0-4797-82cd-840c0a3e5fbe?source=api-prod
- 2015-08-20 MEDIUM: Cross-Site Scripting (up to 1.3.17). CVE-2015-9304, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d8bee60-33f8-465b-80a9-90bc7a4d2054?source=api-prod
- 2015-06-18 HIGH: Reflected Cross-Site Scripting (1.2.98 to 1.2.997). WF-461d5d5a-7bc2-4855-bc40-0edb9c538c33, https://www.wordfence.com/threat-intel/vulnerabilities/id/461d5d5a-7bc2-4855-bc40-0edb9c538c33?source=api-prod
- 2015-03-10 CRITICAL: Authorization Bypass to Arbitrary File Upload/Delete (before 1.0.84). WF-0ae243af-619f-4405-b1e0-9b44c1869501, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ae243af-619f-4405-b1e0-9b44c1869501?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=ultimate-member · HTML: https://todaywp.com/plugins/ultimate-member