Read the docs

ultimatemember

Records77All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9

Exploited now

ultimatemember records in CISA KEV

No ultimatemember vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ultimate Member 37 records CRITICAL User Profile & Membership 7 records LOW Forumwp 4 records MEDIUM Jobboardwp 4 records HIGH Ultimatemember 1 record LOW

Records

4 records in Forumwp · all components

TI-2024-36455 CVE-2024-54367 · GHSA-mrfc-m82j-82wf

WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability

Priority MEDIUM 50

Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00714 Published 2024-12-16 No fix listed CWE-502
TI-2024-07813 CVE-2024-8428 · GHSA-ww5m-q9hx-hcf2

Authorization bypass in ultimatemember ForumWP – Forum & Discussion Board

Priority MEDIUM 41

The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00485 Published 2024-09-06 No fix listed CWE-639
TI-2024-10378 CVE-2024-11204 · GHSA-3h9g-jjj6-8wgc

ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter

Priority LOW 27

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00349 Published 2024-12-06 No fix listed CWE-79
TI-2024-10085 CVE-2024-10879 · GHSA-cvvj-5qrc-6g66

ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting

Priority LOW 27

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00397 Published 2024-12-06 No fix listed CWE-79
Open these records in search →