High
CVE-2025-30890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 90
Reset filters
High
CVE-2025-1702
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
Medium
CVE-2024-12276
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
Medium
CVE-2025-22672
Video & Photo Gallery for Ultimate Member <= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-0308
Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection
Medium
CVE-2025-0318
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure
Medium
CVE-2024-12162
Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting
High
CVE-2024-54370
Video & Photo Gallery for Ultimate Member <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2024-10528
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
Medium
CVE-2024-8519
Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-8520
Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change
Medium
CVE-2024-2765
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2024-2123
Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2024-1071
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection
Medium
f5b08a10-f6bc-44a0-865a-5ad71a1772f7
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery
Medium
CVE-2023-33999
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
Critical
CVE-2023-3460
Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates
Medium
CVE-2023-31216
Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication
High
CVE-2022-3383
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select
High
CVE-2022-3384
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
Medium
CVE-2022-3361
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes
Medium
CVE-2022-2445
Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal
Medium
45f32160-36eb-4d66-a6a6-a3d6f2f7bf1a
Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting
High
f4832fbb-94ed-41c4-8434-1972f4d92476
Ultimate Member <= 2.4.1 - Username Enumeration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.