Vulnerabilities in ultimatemember

31 results
Vexday analysis

Ultimate Member apresenta 30 vulnerabilidades catalogadas, com apenas 1 de severidade crítica e nenhuma sob ataque ativo no momento. A fraqueza dominante é injeção de scripts (CWE-79), tipicamente em contextos web, com 3 novas vulnerabilidades divulgadas nos últimos 90 dias indicando descobertas contínuas. O risco é moderado, sem evidência de exploração em massa, mas exige atenção regular às atualizações de segurança.

CVE-2024-12276MEDIUMUltimate Member <= 2.9.2 - Authenticated SQL InjectionEPSS 0.4%CVE-2025-0318MEDIUMUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information ExposureEPSS 0.4%CVE-2024-11204MEDIUMForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-8520MEDIUMUltimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status ChangeEPSS 0.3%CVE-2025-14081MEDIUMUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting BypassEPSS 0.3%CVE-2025-13217MEDIUMUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'EPSS 0.3%CVE-2026-18547MEDIUMUltimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)EPSS 0.3%CVE-2025-15064MEDIUMUltimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM GadgetsEPSS 0.3%CVE-2025-13220MEDIUMUltimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-1404MEDIUMUltimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter ParametersEPSS 0.2%CVE-2025-13746MEDIUMForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display NameEPSS 0.2%