Known vulnerabilities in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.

74Reported vulnerabilities

9.8Highest CVSS score

2.12.1Latest version

200,000+Active installs

What to do now

Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin to 2.13.0 or later. 74 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 6, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-1071	Critical 9.8	89.4%	2.1.3 up to (but not including) 2.8.3	`2.8.3`	March 13, 2024
CVE-2023-3460	Critical 9.8	72.3%	Before 2.6.7	`2.6.7`	July 4, 2023
CVE-2020-36155	Critical 9.8	9.0%	Before 2.1.12	`2.1.12`	January 4, 2021
CVE-2024-2123	Medium 6.1	26.7%	Before 2.8.4	`2.8.4`	March 13, 2024
CVE-2020-36157	Critical 9.8	3.0%	Before 2.1.12	`2.1.12`	January 4, 2021
CVE-2020-36156	High 8.8	2.0%	Before 2.1.12	`2.1.12`	January 4, 2021
CVE-2019-10673	High 8.8	1.8%	Before 2.0.40	`2.0.40`	April 3, 2019
CVE-2019-10270	High 8.8	1.2%	Before 2.0.40	`2.0.40`	June 21, 2019
CVE-2022-3383	High 7.2	2.8%	2.5.0 and earlier	`2.5.1`	November 29, 2022
CVE-2022-3384	High 7.2	2.7%	2.5.0 and earlier	`2.5.1`	November 29, 2022
CVE-2015-8354	Medium 6.1	2.1%	1.3.28 and earlier	`1.3.29`	September 11, 2017
CVE-2018-17866	Medium 6.1	1.6%	Before 2.0.28	`2.0.28`	October 9, 2018
CVE-2018-6944	Medium 6.1	1.2%	2.0 to 2.0 (inclusive)	`2.0.4`	February 16, 2018
CVE-2022-1208	Medium 5.4	0.9%	2.3.2 and earlier	`2.4.0`	June 13, 2022
CVE-2019-14947	Medium 5.4	0.9%	Before 2.0.52	`2.0.52`	August 12, 2019
CVE-2019-14946	Medium 5.4	0.8%	Before 2.0.52	`2.0.52`	August 12, 2019
CVE-2019-14945	Medium 5.4	0.9%	Before 2.0.54	`2.0.54`	August 12, 2019
WF-bab67a5c-3390-4423-8fa9-b5ffbc98324d	Critical 9.8	—	1.3.83 and earlier	`1.3.84`	April 17, 2017
WF-8911642f-6061-42a1-b733-8cc44b2870f1	Critical 9.8	—	1.3.75 and earlier	`1.3.76`	December 6, 2016
WF-0ae243af-619f-4405-b1e0-9b44c1869501	Critical 9.8	—	Before 1.0.84	`1.0.84`	March 10, 2015
CVE-2022-1209	Medium 5.4	0.7%	2.3.1 and earlier	`2.3.2`	May 10, 2022
CVE-2021-24306	Medium 5.4	0.6%	Before 2.1.20	`2.1.20`	May 24, 2021
WF-618f644b-a92c-4f7f-aaea-c03ee7d6e0f9	Critical 9.4	—	2.0.45 and earlier	`2.0.46`	May 13, 2019
CVE-2022-3361	Medium 4.3	2.5%	2.5.0 and earlier	`2.5.1`	November 29, 2022
WF-cc046b72-692a-4980-90ad-26c8fc2a131a	Critical 9.1	—	Before 1.3.65	`1.3.65`	July 10, 2016
CVE-2026-7761	High 8.8	0.7%	0 to 2.11.4 (inclusive)	`2.12.0`	June 24, 2026
CVE-2018-10234	Medium 4.8	0.6%	Before 2.0.11	`2.0.11`	April 23, 2018
CVE-2018-10233	High 8.8	0.7%	Before 2.0.7	`2.0.7`	April 23, 2018
WF-5143a2d2-504a-46b8-b82b-19beba4da64d	High 8.8	—	Before 2.0.22	`2.0.22`	August 8, 2018
CVE-2018-0588	High 7.5	2.6%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2026-4248	High 8	0.2%	0 to 2.11.2 (inclusive)	`2.11.3`	March 27, 2026
CVE-2026-15290	High 7.5	0.5%	0 to 2.10.1 (inclusive)	`2.10.2`	July 10, 2026
CVE-2025-1702	High 7.5	0.7%	0 to 2.10.0 (inclusive)	`2.10.1`	March 5, 2025
CVE-2025-0308	High 7.5	0.5%	Before 2.9.2	`2.9.2`	January 18, 2025
WF-f4832fbb-94ed-41c4-8434-1972f4d92476	High 7.5	—	2.4.1 and earlier	`2.4.2`	July 14, 2022
CVE-2026-19423	High 7.3	0.3%	2.6.7 to 2.12.1 (inclusive)	`2.13.0`	August 28, 2026
CVE-2026-12251	High 7.3	0.2%	Before 2.12.1	`2.12.1`	August 5, 2026
CVE-2025-47691	High 7.2	0.3%	2.10.3 and earlier	`2.10.4`	May 7, 2025
WF-461d5d5a-7bc2-4855-bc40-0edb9c538c33	High 7.1	—	1.2.98 to 1.2.997 (inclusive)	`1.3.0`	June 18, 2015
CVE-2026-8489	Medium 6.4	0.4%	0 to 2.11.4 (inclusive)	`2.12.0`	July 3, 2026
CVE-2025-15064	Medium 6.4	0.3%	2.11.1 and earlier	`2.11.2`	April 3, 2026
CVE-2025-13217	Medium 6.4	0.3%	0 to 2.11.0 (inclusive)	`2.11.1`	December 17, 2025
CVE-2024-12276	Medium 6.5	0.4%	Before 2.10.0	`2.10.0`	February 21, 2025
CVE-2018-20965	Medium 6.1	1.0%	Before 2.0.4	`2.0.4`	August 12, 2019
CVE-2016-10872	Medium 6.1	1.0%	Before 1.3.40	`1.3.40`	August 12, 2019
CVE-2015-9304	Medium 6.1	1.0%	Before 1.3.18	`1.3.18`	August 12, 2019
CVE-2018-13136	Medium 6.1	1.5%	Before 2.0.18	`2.0.18`	July 4, 2018
CVE-2026-18547	Medium 6.4	0.2%	0 to 2.12.1 (inclusive)	`2.13.0`	August 25, 2026
CVE-2025-13220	Medium 6.4	0.2%	0 to 2.11.0 (inclusive)	`2.11.1`	December 21, 2025
WF-d0c0562f-1f3b-4630-bbc5-4ea2985d71d1	Medium 6.4	—	2.0.45 and earlier	`2.0.46`	May 13, 2019
CVE-2026-1404	Medium 6.1	0.2%	0 to 2.11.1 (inclusive)	`2.11.2`	February 18, 2026
WF-db3b206d-16c5-48fb-800d-d017a0c76630	Medium 6.1	—	Before 2.1.7	`2.1.7`	July 23, 2020
CVE-2020-6859	Medium 5.3	2.2%	2.1.2 and earlier	`2.1.3`	January 13, 2020
WF-a2e1948a-9513-43e4-aadd-369a7f4dc137	Medium 6.1	—	2.0.32 and earlier	`2.0.33`	November 27, 2018
WF-b1be1928-a278-48d5-beb2-00e3c8df3fa9	Medium 6.1	—	Before 2.0.22	`2.0.22`	August 9, 2018
CVE-2020-36170	Medium 5.3	1.1%	Before 2.1.13	`2.1.13`	January 6, 2021
CVE-2018-0585	Medium 5.4	1.0%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2025-12492	Medium 5.3	0.5%	0 to 2.11.0 (inclusive)	`2.11.1`	December 20, 2025
CVE-2024-8519	Medium 5.4	0.4%	Before 2.8.7	`2.8.7`	October 4, 2024
CVE-2024-2765	Medium 5.4	0.5%	Before 2.8.5	`2.8.5`	May 2, 2024
WF-4890ec6f-ba73-48bd-8dd7-f896d6b4a140	Medium 5.5	—	Before 2.0.46	`2.0.46`	May 13, 2019
CVE-2025-0318	Medium 5.3	0.4%	Before 2.9.2	`2.9.2`	January 18, 2025
WF-45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a	Medium 5.4	—	2.4.0 to 2.4.0 (inclusive)	`2.4.1`	July 15, 2022
CVE-2018-0586	Medium 4.3	1.6%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2022-2445	Medium 4.7	—	1.0 to 2.5.0 (inclusive)	`2.5.1`	October 28, 2022
CVE-2018-0590	Medium 4.3	1.1%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2018-0589	Medium 4.3	1.1%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2018-0587	Medium 4.3	1.1%	Before 2.0.4	`2.0.4`	May 14, 2018
CVE-2024-10528	Medium 4.3	0.6%	Before 2.9.0	`2.9.0`	November 21, 2024
CVE-2019-10271	Medium 4.3	0.9%	Before 2.0.40	`2.0.40`	June 24, 2019
CVE-2025-14081	Medium 4.3	0.3%	0 to 2.11.0 (inclusive)	`2.11.1`	December 17, 2025
CVE-2024-8520	Medium 4.3	0.3%	Before 2.8.7	`2.8.7`	October 4, 2024
WF-f5b08a10-f6bc-44a0-865a-5ad71a1772f7	Medium 4.3	—	2.6.8 and earlier	`2.6.9`	August 8, 2023
CVE-2023-31216	Medium 4.3	0.3%	2.6.0 and earlier	`2.6.1`	May 30, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.