Vulnerabilities in ultimatemember

30 results
Vexday analysis

Ultimate Member apresenta 30 vulnerabilidades catalogadas, com apenas 1 de severidade crítica e nenhuma sob ataque ativo no momento. A fraqueza dominante é injeção de scripts (CWE-79), tipicamente em contextos web, com 3 novas vulnerabilidades divulgadas nos últimos 90 dias indicando descobertas contínuas. O risco é moderado, sem evidência de exploração em massa, mas exige atenção regular às atualizações de segurança.

CVE-2024-11204MEDIUMForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url ParameterEPSS 0.3%CVE-2024-8520MEDIUMUltimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status ChangeEPSS 0.3%CVE-2025-14081MEDIUMUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting BypassEPSS 0.3%CVE-2025-13217MEDIUMUltimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'EPSS 0.3%CVE-2025-15064MEDIUMUltimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM GadgetsEPSS 0.3%CVE-2026-8489MEDIUMUltimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile FieldEPSS 0.2%CVE-2026-4248HIGHUltimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template TagEPSS 0.2%CVE-2025-13220MEDIUMUltimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-1404MEDIUMUltimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter ParametersEPSS 0.2%CVE-2025-13746MEDIUMForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display NameEPSS 0.2%