Known vulnerabilities in Ultimate Member - User Profile & Membership Plugin

Software CPE: cpe:2.3:a:ultimatemember:ultimate-member:*:*:*:*:*:wordpress:*:*
Total vulnerabilities: 26
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ultimate Member - User Profile & Membership Plugin Ultimate Member - User Profile & Membership Plugin is affected by 26 known vulnerabilities: 1 critical, 3 high, 12 medium, 10 low Critical High Medium Low

Vulnerabilities (26)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU105446 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-1702
CWE-89 High
No
No
2.10.1 07.03.2025 SB2025030729
#VU103238 - Exposure of sensitive information to an unauthorized actor
CVE-2025-0318
CWE-200 Medium
No
No
2.9.2 22.01.2025 SB2025012281
#VU103237 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-0308
CWE-89 Medium
No
No
2.9.2 22.01.2025 SB2025012281
#VU77841 - Improper Authorization
CVE-2023-3460
CWE-285 Critical
Available
Exploited
2.6.6 30.06.2023 SB2023063049
#VU68851 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-2445
CWE-22 Medium
No
No
2.5.1 31.10.2022 SB2022103131
#VU68850 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-3361
CWE-22 Medium
No
No
2.5.1 31.10.2022 SB2022103131
#VU68846 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-3383
CWE-94 Medium
No
No
2.5.1 31.10.2022 SB2022103131
#VU68845 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-3384
CWE-94 Medium
No
No
2.5.1 31.10.2022 SB2022103131
#VU45657 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Medium
No
No
2.1.7 13.08.2020 SB2020081301
#VU24502 - Improper Access Control
CVE-2020-6859
CWE-284 Medium
No
No
2.1.3 24.01.2020 SB2020012404
#VU20552 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.0.22 02.09.2019 SB2018081021
#VU20537 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-17866
CWE-79 Low
No
No
2.0.28 02.09.2019 SB2018100605
#VU20416 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-14945
CWE-79 Low
No
No
2.0.54 27.08.2019 SB2019072216
#VU19642 - Cross-Site Request Forgery (CSRF)
CWE-352 Medium
No
No
2.0.33 02.08.2019 SB2018112216
#VU19205 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
2.0.52 17.07.2019 SB2019062409
#VU19204 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
2.0.51 17.07.2019 SB2019062409
#VU18597 - Exposure of sensitive information to an unauthorized actor
CWE-200 High
No
No
2.0.46 24.05.2019 SB2019052409
#VU18595 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
2.0.46 23.05.2019 SB2019052319
#VU18594 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Medium
No
No
2.0.46 23.05.2019 SB2019052318
#VU18146 - Cross-Site Request Forgery (CSRF)
CVE-2019-10673
CWE-352 Medium
No
No
2.0.40 06.04.2019 SB2019040605


Showing elements 1 - 20 out of 26