Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
Ultimate Member - Path Traversal (CVE-2018-0588)
Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary files via unspecified vectors.
PLUGIN
Ultimate Member
CVE-2018-0588
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Cross-Site Scripting (XSS) (CVE-2018-0585)
Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
PLUGIN
Ultimate Member
CVE-2018-0585
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Arbitrary File Upload (CVE-2018-0587)
Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.
PLUGIN
Ultimate Member
CVE-2018-0587
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Path Traversal (CVE-2018-0586)
Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors.
PLUGIN
Ultimate Member
CVE-2018-0586
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Cross-Site Request Forgery (CSRF) (CVE-2018-10233)
The User Profile & Membership plugin before 2.0.7 for WordPress has no mitigations implemented against cross site request forgery attacks. This is a structural finding throughout the entire plugin.
PLUGIN
Ultimate Member
CVE-2018-10233
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Cross-Site Scripting (XSS) (CVE-2018-10234)
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=um_options§ion=account page.
PLUGIN
Ultimate Member
CVE-2018-10234
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Cross-Site Scripting (XSS) (CVE-2018-6944)
core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable.
PLUGIN
Ultimate Member
CVE-2018-6944
Risk Score
Threat Entry
Updated 2026-06-17
Ultimate Member - Cross-Site Scripting (XSS) (CVE-2015-8354)
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _refer parameter to wp-admin/users.php.
PLUGIN
Ultimate Member
CVE-2015-8354
Risk Score