Known Vulnerabilities for Ultimate Member by Ultimatemember

Listed below are 10 of the newest known vulnerabilities associated with "Ultimate Member" by "Ultimatemember".

These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.

Data on known vulnerable versions is also displayed based on information from known CPEs

Known Vulnerabilities

CVE Shortened Description Severity Publish Date Last Modified
CVE-2026-4248 The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including... Not Provided 2026-03-27 2026-04-01
CVE-2025-47691 Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member al... Not Provided 2025-05-07 2026-04-01
CVE-2025-32121 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SuitePlugins Video & Ph... Not Provided 2025-04-04 2026-04-01
CVE-2025-30890 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Suit... Not Provided 2025-03-27 2026-04-01
CVE-2025-22672 Server-Side Request Forgery (SSRF) vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultima... Not Provided 2025-03-27 2026-04-01
CVE-2024-54370 Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member galle... Not Provided 2024-12-16 2026-04-01
CVE-2024-54367 Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects... Not Provided 2024-12-16 2026-04-01
CVE-2021-24306 The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not pro... 5.4 - MEDIUM 2021-05-24 2023-11-07
CVE-2020-36170 The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. 5.3 - MEDIUM 2021-01-06 2021-01-08
CVE-2020-36157 An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation v... 9.8 - CRITICAL 2021-01-04 2021-07-21
Results limited to 10 most recent vulnerabilities

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationUltimatememberUltimate Member2.39AllAllAll
ApplicationUltimatememberUltimate Member2.1.9AllAllAll
ApplicationUltimatememberUltimate Member2.1.8AllAllAll
ApplicationUltimatememberUltimate Member2.1.7AllAllAll
ApplicationUltimatememberUltimate Member2.1.6AllAllAll
ApplicationUltimatememberUltimate Member2.1.5AllAllAll
ApplicationUltimatememberUltimate Member2.1.4AllAllAll
ApplicationUltimatememberUltimate Member2.1.3AllAllAll
ApplicationUltimatememberUltimate Member2.1.2AllAllAll
ApplicationUltimatememberUltimate Member2.1.15AllAllAll
ApplicationUltimatememberUltimate Member2.1.14AllAllAll
ApplicationUltimatememberUltimate Member2.1.13AllAllAll
ApplicationUltimatememberUltimate Member2.1.12AllAllAll
ApplicationUltimatememberUltimate Member2.1.11AllAllAll
ApplicationUltimatememberUltimate Member2.1.10AllAllAll
ApplicationUltimatememberUltimate Member2.0.9AllAllAll
ApplicationUltimatememberUltimate Member2.0.8AllAllAll
ApplicationUltimatememberUltimate Member2.0.7AllAllAll
ApplicationUltimatememberUltimate Member2.0.6AllAllAll
ApplicationUltimatememberUltimate Member2.0.54AllAllAll
Results limited to 20 most recent known configurations
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report