Unknown Ultimate Member vulnerabilities

5 CVEs affecting Unknown Ultimate Member, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85680, published 2026-09-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-85680, published 2026-09-19. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its…
CVE-2026-11766, published 2026-07-06. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated…
CVE-2026-12251, published 2026-07-31. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard…
CVE-2026-19251, published 2026-09-02. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to…
CVE-2026-19423, published 2026-08-28. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the…