Ultimate Member — Vulnerabilities & Security Advisories 11

Ultimate Member is a WordPress plugin for user profile and membership management. Historically, it has been vulnerable to multiple security issues including cross-site scripting (XSS), remote code execution (RCE), privilege escalation, and authentication bypass. With 11 CVEs recorded, the plugin has faced recurring flaws in input validation, access controls, and file handling. Notable incidents include multiple XSS vulnerabilities allowing attacker-controlled script execution in user profiles and RCE issues through improper file processing. The plugin's extensive permissions and user interaction features have consistently created attack surfaces, with many vulnerabilities stemming from insufficient sanitization of user-supplied data and inadequate privilege checks.