High
CVE-2026-93428
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 90
Reset filters
High
CVE-2026-96270
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
Medium
CVE-2026-96451
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-62059
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-85680
Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-19251
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure
High
CVE-2026-19423
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-18547
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
High
CVE-2026-12251
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-8489
Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field
High
CVE-2026-7761
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
Medium
CVE-2026-11766
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-15064
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
High
CVE-2026-4248
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
Medium
CVE-2026-1404
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
Medium
CVE-2025-13220
Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-12492
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14081
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass
Medium
CVE-2025-13217
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
Medium
CVE-2025-66116
Ultimate Member Widgets for Elementor <= 2.3 - Unauthenticated Information Exposure
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
High
CVE-2025-47691
Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call
High
CVE-2026-15290
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
Medium
CVE-2025-32121
Video & Photo Gallery for Ultimate Member <= 1.1.3 - Authenticated (Administrator+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.