Ultimate Member
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:ultimate_member:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Ultimate Member (8f20175d-2c8e-5ab3-9c22-467e668490bf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12251 |
vulnerable | 2026-09-16 04:32:51.558413 |
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Published: 2026-07-31T06:00:10.354Z
Updated: 2026-07-31T16:55:03.841Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11766 |
vulnerable | 2026-07-29 00:23:31.580167 |
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Published: 2026-07-06T06:00:01.483Z
Updated: 2026-07-06T12:02:30.806Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3460 |
vulnerable | 2026-06-08 06:09:39.625665 |
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
Published: 2023-07-04T07:23:28.852Z
Updated: 2024-11-25T16:47:17.644Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.