Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 73 vulnerability records associated with Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

73Total records
10Critical
15High
48Medium
0Low
0Informational
73Patched records
0Currently marked unpatched
2015-03-10First disclosure
2026-07-02Latest disclosure
58 of 73CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201544 records
201633 records
201711 records
20181313 records
20191313 records
202066 records
202111 records
202288 records
202333 records
202466 records
20251010 records
202655 records

Severity Breakdown

SeverityRecordsShare
Critical1013.7%
High1520.5%
Medium4865.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

29 records39.7%

First: 2015. Latest: 2026.

Missing Authorization

10 records13.7%

First: 2015. Latest: 2026.

Privilege Escalation

7 records9.6%

First: 2018. Latest: 2023.

Other

6 records8.2%

First: 2016. Latest: 2025.

CSRF

6 records8.2%

First: 2018. Latest: 2024.

Path Traversal

5 records6.8%

First: 2018. Latest: 2022.

SQL Injection

5 records6.8%

First: 2024. Latest: 2025.

Information Disclosure

3 records4.1%

First: 2022. Latest: 2025.

Arbitrary File Upload

2 records2.7%

First: 2018. Latest: 2018.

Patch Status

Patched
73
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.12.0
  • 2.11.2
  • 2.11.3
  • 2.11.1
  • 2.10.4
  • 2.10.2
  • 2.10.1
  • 2.10.0
  • 2.9.2
  • 2.9.0
  • 2.8.7
  • 2.8.5
  • 2.8.4
  • 2.8.3
  • 2.6.9
  • 2.6.7
  • 2.6.1
  • 2.5.1
  • 2.4.1
  • 2.4.2
  • 2.3.2
  • 2.4.0
  • 2.1.20
  • 2.1.13
  • 2.1.12
  • 2.1.7
  • 2.1.3
  • 2.0.4
  • 2.0.54
  • 2.0.52
  • 2.0.40
  • 2.0.46
  • 2.0.33
  • 2.0.28
  • 2.0.22
  • 2.0.18
  • 2.0.7
  • 2.0.11
  • 1.3.84
  • 1.3.76
  • 1.3.65
  • 1.3.40
  • 1.3.29
  • 1.3.18
  • 1.3.0
  • 1.0.84

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 2.0.46)Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site ScriptingMay 13, 20192.0.46Medium
[*, 2.0.40)Ultimate Member <= 2.0.39 - Cross-Site Request ForgeryApril 1, 20192.0.40High
*-2.0.32Ultimate Member <= 2.0.32 - Cross-Site Request ForgeryNovember 27, 20182.0.33Medium
*-2.0.27Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilitiesOctober 6, 20182.0.28Medium
[*, 2.0.22)Ultimate Member <= 2.0.21 - Cross-Site ScriptingAugust 9, 20182.0.22Medium
[*, 2.0.22)Ultimate Member <= 2.0.21 - Arbitrary File UploadAugust 8, 20182.0.22High
*-2.0.17Ultimate Member <= 2.0.17 - Authenticated Cross-Site ScriptingJuly 3, 20182.0.18Medium
*-2.0.3Ultimate Member <= 2.0.3 - Improper Access ControlMay 14, 20182.0.4Medium
[*, 2.0.4)Ultimate Member < 2.0.4 - Authenticated Unrestricted File UploadMay 10, 20182.0.4Medium
*-2.0.39Ultimate Member <= 2.0.39 - Directory TraversalMay 10, 20182.0.40Medium
[*, 2.0.4)Ultimate Member < 2.0.4 - Insecure Direct Object ReferenceMay 10, 20182.0.4Medium
[*, 2.0.7)Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery IssuesApril 23, 20182.0.7High
[*, 2.0.11)Ultimate Member <= 2.0.10 - Authenticated Cross-Site ScriptingApril 23, 20182.0.11Medium
*-2.0Ultimate Member <= 2.0 - Cross-Site ScriptingFebruary 14, 20182.0.4Medium
[*, 2.0.4)Ultimate Member <= 2.0.3 - Cross-Site ScriptingFebruary 14, 20182.0.4Medium
*-1.3.83Ultimate Member <= 1.3.83 - Shortcode InjectionApril 17, 20171.3.84Critical
*-1.3.75Ultimate Member <= 1.3.75 - Missing Authorization to Password ResetDecember 6, 20161.3.76Critical
[*, 1.3.65)Ultimate Member <= 1.3.64 - Local File InclusionJuly 10, 20161.3.65Critical
[*, 1.3.40)Ultimate Member <= 1.3.39 - Cross-Site ScriptingApril 6, 20161.3.40Medium
[*, 1.3.29)Ultimate Member <= 1.3.28 - Reflected Cross-Site ScriptingDecember 2, 20151.3.29Medium
*-1.3.17Ultimate Member <= 1.3.17 - Cross-Site ScriptingAugust 20, 20151.3.18Medium
1.2.98-1.2.997Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site ScriptingJune 18, 20151.3.0High
[*, 1.0.84)Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/DeleteMarch 10, 20151.0.84Critical

Selected source records

Latest Records

MediumCVE-2026-8489

Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field

Published: July 2, 2026

Affected versions
*-2.11.4
Patched versions
2.12.0
Original Wordfence record
HighCVE-2026-7761

Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure

Published: June 23, 2026

Affected versions
*-2.11.4
Patched versions
2.12.0
Original Wordfence record
MediumCVE-2025-15064

Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets

Published: April 3, 2026

Affected versions
*-2.11.1
Patched versions
2.11.2
Original Wordfence record
HighCVE-2026-4248

Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag

Published: March 27, 2026

Affected versions
*-2.11.2
Patched versions
2.11.3
Original Wordfence record
MediumCVE-2026-1404

Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters

Published: February 17, 2026

Affected versions
*-2.11.1
Patched versions
2.11.2
Original Wordfence record
MediumCVE-2025-13220

Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Published: December 20, 2025

Affected versions
*-2.11.0
Patched versions
2.11.1
Original Wordfence record
MediumCVE-2025-12492

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure

Published: December 19, 2025

Affected versions
*-2.11.0
Patched versions
2.11.1
Original Wordfence record
MediumCVE-2025-13217

Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'

Published: December 16, 2025

Affected versions
*-2.11.0
Patched versions
2.11.1
Original Wordfence record

Highest-Severity Records

CriticalCVE-2020-36157

Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles

Published: November 9, 2020

Affected versions
[*, 2.1.12)
Patched versions
2.1.12
Original Wordfence record
CriticalCVE-2020-36155

Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta

Published: November 9, 2020

Affected versions
[*, 2.1.12)
Patched versions
2.1.12
Original Wordfence record
CriticalCVE-2020-36156

Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update

Published: November 9, 2020

Affected versions
[*, 2.1.12)
Patched versions
2.1.12
Original Wordfence record
CriticalCVE-2024-1071

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection

Published: February 23, 2024

Affected versions
2.1.3-2.8.2
Patched versions
2.8.3
Original Wordfence record
Critical

Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete

Published: March 10, 2015

Affected versions
[*, 1.0.84)
Patched versions
1.0.84
Original Wordfence record
CriticalCVE-2023-3460

Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates

Published: June 29, 2023

Affected versions
*-2.6.6
Patched versions
2.6.7
Original Wordfence record
Critical

Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset

Published: December 6, 2016

Affected versions
*-1.3.75
Patched versions
1.3.76
Original Wordfence record
Critical

Ultimate Member <= 1.3.83 - Shortcode Injection

Published: April 17, 2017

Affected versions
*-1.3.83
Patched versions
1.3.84
Original Wordfence record

View all associated vulnerabilities

3Zero Interpretation

Ultimate Member’s history is especially relevant to websites that depend on public registration, profile editing and role-based access. The synchronized dataset contains 73 records from March 2015 through July 2026, including 10 critical and 15 high-severity records. Cross-site scripting accounts for 29 records (39.7%), while missing authorization, privilege escalation and other access-related categories form a second important cluster.

The pattern matters because this plugin operates close to identity and account workflows. Recent records include stored cross-site scripting through custom profile fields and a high-severity password-reset-link disclosure record affecting versions through 2.11.4. Historical record count is not a quality score, but repeated findings around profiles, permissions and account recovery justify careful version control and role testing on membership sites.

All 73 associated records are currently marked patched in the synchronized source. That does not mean every installed version is safe; it means a patched state is recorded for each imported vulnerability.

Practical Next Steps

  1. Confirm the installed Ultimate Member version. The latest synchronized records include affected ranges through 2.11.4, while the dataset lists 2.12.0 among known patched values.
  2. Update the plugin and its extensions together. Back up the site, review extension compatibility and test registration, login, password reset, profile editing and restricted-content rules after updating.
  3. Audit membership privileges. Review custom roles, default registration roles, administrator assignments and any capability changes made by snippets or add-ons.
  4. Inspect user-controlled profile fields. Pay particular attention to rich text, textarea and custom fields that are rendered publicly or inside administrative screens.
  5. Investigate account anomalies when exposure existed. Unexpected password resets, new administrators, unexplained profile changes or access to restricted content warrant a focused account and log review; vulnerability history alone does not prove compromise.

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory