Ultimate Member (Unknown) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-19. Vendor: Unknown.

CVEs of Ultimate Member

• CVE-2026-85680 - CVSS 8.8 (high), 2026-09-19: The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title,…
• CVE-2026-19251 - CVSS 5.3 (medium), 2026-09-02: The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before…
• CVE-2026-19423 - CVSS 8.1 (high), 2026-08-28: The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form…
• CVE-2026-12251 - CVSS 8.1 (high), 2026-07-31: The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration…
• CVE-2026-11766 - CVSS 8 (high), 2026-07-06: The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on…
• CVE-2023-3460 - CVSS 9.8 (critical), 2023-07-04: The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing…