Ultimate Member
Monthly
PHP object injection in the Ultimate Member WordPress plugin through 2.13.1 allows unauthenticated remote attackers to pass untrusted serialized data into the plugin, carrying a CVSS 9.8 score and a vuln.today act_now priority. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability without authentication or user interaction, but the exact endpoint, parameter, or feature that reaches unserialize() is not described in the available sources. No public exploit was identified at time of analysis and no KEV entry is present in the supplied data; practical impact depends on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress/PHP environment, and the high-priority signal rests on limited sourcing.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level users inject persistent JavaScript through custom textarea profile fields, which executes in the browser of any visitor - including administrators - who views the poisoned profile. Publicly available exploit code exists (WPScan), though EPSS is low (0.17%) and SSVC records no observed exploitation, so this is a real but not yet actively-exploited privilege-escalation-capable XSS.
Privilege escalation in the Ultimate Member WordPress plugin (all versions through 2.13.1) arises from an incorrect privilege assignment that lets a user reach permissions beyond those they should legitimately hold. The assessed vector - CVSS 5.6 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) - combines high attack complexity with low-privileged access, meaning exploitation depends on specific conditions rather than a single trivial request, and the resulting confidentiality, integrity, and availability impact is limited rather than site-takeover grade. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), so this should be treated as a moderate-priority patch item for any WordPress site running the plugin at or below 2.13.1.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection via filenames in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Skype and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.6%.
Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 38.4%.
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 34.9%.
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0.php of the component Template Handler. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member - User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ultimate-member plugin before 2.0.54 for WordPress has XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
PHP object injection in the Ultimate Member WordPress plugin through 2.13.1 allows unauthenticated remote attackers to pass untrusted serialized data into the plugin, carrying a CVSS 9.8 score and a vuln.today act_now priority. The assessed vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability without authentication or user interaction, but the exact endpoint, parameter, or feature that reaches unserialize() is not described in the available sources. No public exploit was identified at time of analysis and no KEV entry is present in the supplied data; practical impact depends on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress/PHP environment, and the high-priority signal rests on limited sourcing.
Privilege escalation in the Ultimate Member WordPress plugin affects all versions through 2.13.1, allowing an authenticated attacker to manipulate a user-controlled key that the plugin fails to bind to the requester's own account or privileges, thereby elevating a low-privilege account to a higher role such as administrator. The flaw requires an authenticated account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8), but because Ultimate Member supplies front-end user registration, an attacker can typically self-register on sites with open registration enabled - the common deployment mode - lowering the practical barrier to entry; sites that disable open registration require a pre-existing credential. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV), though the low attack complexity and high confidentiality, integrity, and availability impact make rapid patching a priority, with no EPSS score supplied in the available intelligence.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. Publicly available exploit code exists, a vendor patch is available as 2.13.1, and the assessed confidentiality and integrity impact is high, which is why this reads as a genuine priority rather than a high-CVSS-but-low-risk paper cut.
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows unauthenticated users registering via the plugin's own forms to self-assign any WordPress role, including administrator, by exploiting a logic failure in role validation. When the plugin cannot resolve the allowed roles for a given profile form, it falls back to validating the submitted role against the full site-wide role registry rather than the form's own allow-list - accepting any valid registered role. A publicly available exploit exists per WPScan, though SSVC assessment indicates no confirmed active exploitation campaigns at time of analysis. Vendor-released patch is available in version 2.13.0.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level users inject persistent JavaScript through custom textarea profile fields, which executes in the browser of any visitor - including administrators - who views the poisoned profile. Publicly available exploit code exists (WPScan), though EPSS is low (0.17%) and SSVC records no observed exploitation, so this is a real but not yet actively-exploited privilege-escalation-capable XSS.
Privilege escalation in the Ultimate Member WordPress plugin (all versions through 2.13.1) arises from an incorrect privilege assignment that lets a user reach permissions beyond those they should legitimately hold. The assessed vector - CVSS 5.6 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) - combines high attack complexity with low-privileged access, meaning exploitation depends on specific conditions rather than a single trivial request, and the resulting confidentiality, integrity, and availability impact is limited rather than site-takeover grade. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), so this should be treated as a moderate-priority patch item for any WordPress site running the plugin at or below 2.13.1.
Unauthenticated information disclosure in the Ultimate Member WordPress plugin (all versions before 2.13.0) exposes the content of comments still awaiting moderation and activity from private user profiles to any anonymous visitor. The plugin's profile activity endpoint fails to verify both comment approval status and profile privacy settings before returning data, meaning moderated/private content is served as if it were public. A publicly available proof-of-concept exists; no active exploitation has been confirmed via CISA KEV.
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second-order SQL Injection via filenames in. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the search. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Skype and. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 29.6%.
Cross-Site Request Forgery (CSRF) vulnerability in Ultimate Member plugin <= 2.6.0 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 38.4%.
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 34.9%.
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0.php of the component Template Handler. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member - User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ultimate-member plugin before 2.0.54 for WordPress has XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.