Known vulnerabilities in Ultimate Dashboard – Custom WordPress Dashboard

The #1 Plugin to Customize the WordPress Dashboard!

10Reported vulnerabilities

7.2Highest CVSS score

3.8.17Latest version

60,000+Active installs

What to do now

Update Ultimate Dashboard – Custom WordPress Dashboard to 3.8.15 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 6, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-50828	Medium 4.8	0.4%	3.7.11 and earlier	`3.7.12`	December 21, 2023
CVE-2023-2812	Medium 4.8	0.5%	Before 3.7.6	`3.7.6`	June 19, 2023
CVE-2025-1525	Low 3.5	0.3%	Before 3.8.6	`3.8.6`	April 17, 2025
CVE-2025-1524	Low 3.5	0.3%	Before 3.8.6	`3.8.6`	April 17, 2025
CVE-2025-1523	Low 3.5	0.3%	Before 3.8.6	`3.8.6`	April 17, 2025
CVE-2026-66621	High 7.2	0.2%	3.11.2 and earlier	—	August 18, 2026
CVE-2023-49822	Medium 5.3	0.3%	3.7.10 and earlier	`3.7.11`	December 5, 2023
CVE-2023-4726	Medium 4.8	0.4%	3.7.7 and earlier	`3.7.8`	November 22, 2023
CVE-2026-3140	Medium 4.3	0.2%	0 to 3.8.14 (inclusive)	`3.8.15`	May 1, 2026
CVE-2025-2276	Medium 4.3	0.2%	0 to 3.8.7 (inclusive)	`3.8.8`	March 26, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.