Plugin Pulse Beta
← Pulse

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

by Ultimate Member · Membership

Also makes 2 other plugins · 201.7K+ installs across the portfolio →

Try it live ↗ wp.org ↗

Membership & community plugin with user profiles, registration & login, member directories, content restriction, user roles and much more.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

A 86/100

no flags

Active installs

200K+

≈290K estimated

Momentum

+55%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 63/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
86 Health · A
Maintenance 100/100
Rating quality 85/100
Support 72/100
Security 75/100

86 health vs 71 average across 298 Membership plugins

200K+

Active installs

≈290K estimated

13.9M

Total downloads

since 2015 · 1.4% still active

4.4/5

Rating

1,445 reviews

+55%

166.3K

Downloads · 30d

category median +6%

Install conversion

How it's measured →

1.4%

of downloads still active

At least 200K of 13.9M lifetime downloads are still running, above its category: the median Membership plugin keeps 0.9%, across 166 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Membership plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 11 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 1445 reviews

Read on wp.org ↗
5★
1138 4★
69 3★
38 2★
46 1★
154

Details

Version
2.14.1
Last updated
9d ago
Added
2015-01-21 · 11 yrs old
Requires WP
6.2
Tested up to
7.1.4
Requires PHP
7.0
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

92 / 100

Excellent listing optimization

Most to gain: Support resolution

Update recency 100/100

Updated 9 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 88/100

4.4★ over 1,445 reviews, smoothed to 4.39★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 63/100

25 of 40 support threads resolved in the last 2 months

To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,489 days · wp.org + Plugin Pulse archive

+55% vs prior 30d
2.2K1 Nov 2026

30-day downloads

Rolling 30-day volume · peak 611.6K · peaks are release surges

162K1 Nov 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Ultimate Member · #274youUltimate Member · #1211Ultimate Member · #3420Ultimate Member · #4004

Rating trend

Star average over time · dips mark rough releases

4.41 Nov 2026

Health trend

Composite health score, snapshotted daily

861 Nov 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

8101 Nov 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

11

releases in the last 12 months

9d ago

latest release · v2.14.1 · 23 Oct 2026

315

tagged releases on record

Recent releases

2.14.1 · 23 Oct 20262.14.0 · 29 Sep 20262.13.1 · 15 Sep 20262.13.0 · 24 Aug 20262.12.1 · 6 Jul 20262.12.0 · 12 Jun 20262.11.4 · 30 Apr 20262.11.3 · 26 Mar 20262.11.2 · 10 Feb 20262.11.1 · 16 Dec 20252.11.0 · 2 Dec 20252.10.6 · 2 Oct 20252.10.5 · 25 Jun 20252.10.4 · 14 May 2025

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v2.12 47%
v2.11 20%
v2.10 12%
v2.8 6.4%
Older / other versions 15%

Estimated active installs

The public count shows “200K+”. Our estimate pins where the real number sits.

tracked estimate
200K–300K ≈290K

Crossed into this band 5.8 years ago; the previous band took 2.7 years to cross, which places it about 90% of the way through.

Install history since 1 Oct 2021

200K1 Nov 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ laquituck
    7mo ago

    It’s very limiting; its templates are basic, you can’t control the images that users upload, and they have very low resolution, which makes it unprofessional. This topic was modified 3 months, 2 weeks ago by laquituck.

    Read on wp.org ↗
  2. ★★★★★ Melody Chaney
    7mo ago

    This plugin never works right. It’s just one screw-up after another that I keep running into. And the support is never able to help (for free). I spend more time trying to fix this plugin than I spend working on anything else on my website. I was having a problem where my user profiles were showing the wrong profile pic. So the user profile pics were showing other people’s profile pics from other profile forms. When I asked support to help me figure out the problem, they offered to solve it for me for $100! Imagine that! They wanted to charge me $100 to fix THEIR SCREWUP! I asked them to just offer suggestions for free on how I can fix it myself. A couple of support associates refused, but I finally talked to one who did offer suggestions, although they didn’t work. I spent 3 whole days working on this until I finally figured it out myself! Now I’ve run into another problem. When I post a shortcode for a form onto a page, it pulls up the wrong form!

    Read on wp.org ↗
  3. ★★★★★ esther0708
    9mo ago

    I have been reaching out to support and they do not reply or fix the issues. It is disappointing. I will be moving plugins This topic was modified 5 months, 3 weeks ago by esther0708.

    Read on wp.org ↗
  4. ★★★★★ barjinder
    11mo ago

    This is a very good plugin, it helped me to implement restricted content feature on a website easily.

    Read on wp.org ↗
  5. ★★★★★ difko
    1.1y ago

    Seguramente, el mejor plugin para gestionar usuarios, permisos, bloqueos, etc.

    Read on wp.org ↗
  6. ★★★★★ maxellinger
    1.3y ago

    I never leave reviews for plugins, but having just spent several months with Ultimate Member I feel compelled to. I was responsible for migrating a 1,000+ member organization site from an old BuddyPress setup to UM and the transition was lovely. The Stripe integration is particularly well-implemented. Some of the frontend styles and markup are a little outdated, and I would appreciate some easier styling through CSS vars, but my complaints are minimal. All the extensions and sister plugins do what they say on the tin (though the Jobs one needs maybe a little English pass).

    Read on wp.org ↗
  7. ★★★★★ dterry
    1.4y ago

    I’m using this plugin to enhance user profile photo display and it works like a charm. Love how clean and responsive the widget is. It even respects user permissions properly exactly what I needed for a members-only area on my site. Bonus points for not breaking my layout even with heavy CSS customization.

    Read on wp.org ↗
  8. ★★★★★ Phil
    1.5y ago

    Super plugin and easy to use.

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. 2026-10-22 Version 2.14.1 Bugfixes Fixed: CVE-2026-107625 security issue. Added confirmation prompt for external links and improve localization support in frontend scripts. (Reported by Wordfence). Fixed: Reading the icons’ list via UM()->setup() 2.14.1
  2. 2026-09-29 Version 2.14.0 Enhancements Added: $form_id parameter to the action hooks um_before_form , um_before_{$mode}_fields , um_main_{$mode}_fields , um_after_form_fields , um_after_{$mode}_fields and um_after_form . Added: Action hook um_bef 2.14.0
  3. 2026-09-15 Version 2.13.1 Enhancements Added: Fallback for wp-cli/wp-config-transformer library if the wp-config.php file isn’t writable. Added: Filter hook um_members_directory_filter_text 3rd parameter $is_default to check if it’s admin filteri 2.13.1
  4. 2026-08-24 Version 2.13.0 Enhancements Added: Using illegal_user_logins filter to sanitize the user_login field value during registration or upgrade. Added: Using wp-cli/wp-config-transformer library to set Ultimate Member > API keys settings con 2.13.0
  5. 2026-07-06 Version 2.12.1 Enhancements Added: Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value. Added: The API key field type for the sett 2.12.1
  6. 2026-06-12 Version 2.12.0 Bugfixes Fixed: Security issue, CVE ID: CVE-2026-7761. ** Restricted get_directory_by_hash() function to only match posts with post_type=’um_directory’ and publish post status. ** Used 0 === strpos() instead of strstr() 2.12.0

Security history

via Wordfence Intelligence

All 85 disclosed vulnerabilities are patched in the current version (2.14.1). Sites still on an older version should update.

  1. Patched Medium · 6.4 Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field ↗
    2026-10-27 CVE-2026-107625 Improper Neutralization of Input During Web Page Generation Affects <= 2.14.0 Patched in 2.14.1
  2. Patched High · 7.5 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass ↗
    2026-10-02 CVE-2026-93428 Missing Authorization Affects <= 2.13.1 Patched in 2.14.0
  3. Patched High · 7.2 Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter ↗
    2026-10-02 CVE-2026-96270 Improper Neutralization of Input During Web Page Generation Affects <= 2.13.1 Patched in 2.14.0
  4. Patched High · 7.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated Privilege Escalation ↗
    2026-10-02 CVE-2026-96539 Improper Privilege Management Affects <= 2.13.1 Patched in 2.14.0
  5. Patched Medium · 6.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation ↗
    2026-10-01 CVE-2026-96451 Improper Privilege Management Affects <= 2.13.1 Patched in 2.14.0
  6. Patched Medium · 4.9 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection ↗
    2026-10-01 CVE-2026-62059 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.13.1 Patched in 2.14.0
  7. Patched High · 7.2 Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-17 CVE-2026-85680 Improper Neutralization of Input During Web Page Generation Affects <= 2.13.0 Patched in 2.13.1
  8. Patched Medium · 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure ↗
    2026-08-31 CVE-2026-19251 Exposure of Sensitive Information to an Unauthorized Actor Affects < 2.13.0 Patched in 2.13.0
  9. Patched High · 7.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation ↗
    2026-08-28 CVE-2026-19423 Improper Privilege Management Affects 2.6.7 - 2.12.1 Patched in 2.13.0
  10. Patched Medium · 6.4 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) ↗
    2026-08-24 CVE-2026-18547 Improper Neutralization of Input During Web Page Generation Affects <= 2.12.1 Patched in 2.13.0
  11. Patched High · 7.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation ↗
    2026-08-05 CVE-2026-12251 Incorrect Privilege Assignment Affects < 2.12.1 Patched in 2.12.1
  12. Patched Medium · 6.4 Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field ↗
    2026-07-02 CVE-2026-8489 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.4 Patched in 2.12.0
  13. Patched High · 8.8 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure ↗
    2026-06-23 CVE-2026-7761 Missing Authorization Affects <= 2.11.4 Patched in 2.12.0
  14. Patched Medium · 6.4 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2026-06-15 CVE-2026-11766 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.0 Patched in 2.12.0
  15. Patched Medium · 6.4 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets ↗
    2026-04-03 CVE-2025-15064 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.1 Patched in 2.11.2
  16. Patched High · 8.0 Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag ↗
    2026-03-27 CVE-2026-4248 Improper Authorization Affects <= 2.11.2 Patched in 2.11.3
  17. Patched Medium · 6.1 Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters ↗
    2026-02-17 CVE-2026-1404 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.1 Patched in 2.11.2
  18. Patched Medium · 6.4 Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2025-12-20 CVE-2025-13220 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.0 Patched in 2.11.1
  19. Patched Medium · 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure ↗
    2025-12-19 CVE-2025-12492 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.11.0 Patched in 2.11.1
  20. Patched Medium · 6.4 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value' ↗
    2025-12-16 CVE-2025-13217 Improper Neutralization of Input During Web Page Generation Affects <= 2.11.0 Patched in 2.11.1
  21. Patched Medium · 4.3 Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass ↗
    2025-12-16 CVE-2025-14081 Incorrect Authorization Affects <= 2.11.0 Patched in 2.11.1
  22. Patched High · 7.2 Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call ↗
    2025-05-07 CVE-2025-47691 Improper Control of Generation of Code Affects <= 2.10.3 Patched in 2.10.4
  23. Patched High · 7.5 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection ↗
    2025-04-16 CVE-2026-15290 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.10.1 Patched in 2.10.2
  24. Patched High · 7.5 Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter ↗
    2025-03-04 CVE-2025-1702 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.10.0 Patched in 2.10.1
  25. Patched Medium · 5.3 Ultimate Member <= 2.9.2 - Authenticated SQL Injection ↗
    2025-02-20 CVE-2024-12276 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.9.2 Patched in 2.10.0
  26. Patched Medium · 5.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure ↗
    2025-01-17 CVE-2025-0318 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.9.1 Patched in 2.9.2
  27. Patched High · 7.5 Ultimate Member <= 2.9.1 - Unauthenticated SQL Injection ↗
    2025-01-17 CVE-2025-0308 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.9.1 Patched in 2.9.2
  28. Patched Medium · 4.3 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update ↗
    2024-11-20 CVE-2024-10528 Missing Authorization Affects <= 2.8.9 Patched in 2.9.0
  29. Patched Medium · 5.3 Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change ↗
    2024-10-03 CVE-2024-8520 Cross-Site Request Forgery Affects <= 2.8.6 Patched in 2.8.7
  30. Patched Medium · 6.4 Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-10-03 CVE-2024-8519 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.6 Patched in 2.8.7
  31. Patched Medium · 5.4 Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-04-10 CVE-2024-2765 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.4 Patched in 2.8.5
  32. Patched High · 7.2 Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-03-08 CVE-2024-2123 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.3 Patched in 2.8.4
  33. Patched Critical · 9.8 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.1.3 - 2.8.2 - Unauthenticated SQL Injection ↗
    2024-02-23 CVE-2024-1071 Improper Neutralization of Special Elements used in an SQL Command Affects 2.1.3 - 2.8.2 Patched in 2.8.3
  34. Patched Medium · 4.3 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.6.8 - Cross-Site Request Forgery ↗
    2023-08-08 Cross-Site Request Forgery Affects <= 2.6.8 Patched in 2.6.9
  35. Patched Critical · 9.8 Ultimate Member <= 2.6.6 - Privilege Escalation via Arbitrary User Meta Updates ↗
    2023-06-29 CVE-2023-3460 Incorrect Privilege Assignment Affects <= 2.6.6 Patched in 2.6.7
  36. Patched Medium · 4.3 Ultimate Member <= 2.6.0 - Cross-Site Request Forgery to Form Duplication ↗
    2023-05-30 CVE-2023-31216 Cross-Site Request Forgery Affects <= 2.6.0 Patched in 2.6.1
  37. Patched Medium · 4.7 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Directory Traversal ↗
    2022-10-28 CVE-2022-2445 Improper Limitation of a Pathname to a Restricted Directory Affects 1.0 - 2.5.0 Patched in 2.5.1
  38. Patched Medium · 4.3 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes ↗
    2022-10-28 CVE-2022-3361 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.5.0 Patched in 2.5.1
  39. Patched High · 7.2 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options ↗
    2022-10-28 CVE-2022-3384 Improper Control of Generation of Code Affects <= 2.5.0 Patched in 2.5.1
  40. Patched High · 7.2 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select ↗
    2022-10-28 CVE-2022-3383 Improper Control of Generation of Code Affects <= 2.5.0 Patched in 2.5.1
  41. Patched Medium · 5.4 Ultimate Member <= 2.4.0 - Subscriber+ Stored Cross-Site Scripting ↗
    2022-07-15 Improper Neutralization of Input During Web Page Generation Affects 2.4.0 Patched in 2.4.1
  42. Patched High · 7.5 Ultimate Member <= 2.4.1 - Username Enumeration ↗
    2022-07-14 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.4.1 Patched in 2.4.2
  43. Patched Medium · 4.3 Ultimate Member <= 2.3.1 - Arbitrary Redirect ↗
    2022-04-29 CVE-2022-1209 URL Redirection to Untrusted Site Affects <= 2.3.1 Patched in 2.3.2
  44. Patched Medium · 6.4 Ultimate Member <= 2.3.2 - Stored Cross-Site Scripting ↗
    2022-03-21 CVE-2022-1208 Improper Neutralization of Input During Web Page Generation Affects <= 2.3.2 Patched in 2.4.0
  45. Patched Medium · 6.1 Ultimate Member <= 2.1.19 - Reflected Cross-Site Scripting ↗
    2021-05-07 CVE-2021-24306 Improper Neutralization of Input During Web Page Generation Affects < 2.1.20 Patched in 2.1.20
  46. Patched Medium · 6.5 Ultimate Member <= 2.1.12 - Cross-Site Scripting ↗
    2020-12-09 CVE-2020-36170 Improper Neutralization of Input During Web Page Generation Affects < 2.1.13 Patched in 2.1.13
  47. Patched Critical · 10.0 Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Roles ↗
    2020-11-09 CVE-2020-36157 Improper Privilege Management Affects < 2.1.12 Patched in 2.1.12
  48. Patched Critical · 10.0 Ultimate Member <= 2.1.11 - Unauthenticated Privilege Escalation via User Meta ↗
    2020-11-09 CVE-2020-36155 Improper Privilege Management Affects < 2.1.12 Patched in 2.1.12
  49. Patched Critical · 9.9 Ultimate Member <= 2.1.11 - Authenticated Privilege Escalation via Profile Update ↗
    2020-11-09 CVE-2020-36156 Improper Privilege Management Affects < 2.1.12 Patched in 2.1.12
  50. Patched Medium · 6.1 Ultimate Member <= 2.1.6 - Open Redirect ↗
    2020-07-23 URL Redirection to Untrusted Site Affects < 2.1.7 Patched in 2.1.7
  51. Patched Medium · 5.3 Ultimate Member <= 2.1.2 - Insecure Direct Object Reference ↗
    2020-01-13 CVE-2020-6859 Improper Privilege Management Affects < 2.1.3 Patched in 2.1.3
  52. Patched Medium · 6.1 Ultimate Member <= 1.3.88 - Cross Site Scripting ↗
    2019-08-12 CVE-2018-0585 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.88 Patched in 2.0.4
  53. Patched Medium · 4.3 Ultimate Member <= 2.0.3 - Unauthorized Image File Upload ↗
    2019-08-12 CVE-2018-0587 Improper Authorization Affects <= 2.0.3 Patched in 2.0.4
  54. Patched Medium · 4.3 Ultimate Member <= 2.0.3 - Directory Traversal ↗
    2019-08-12 CVE-2018-0586 Improper Limitation of a Pathname to a Restricted Directory Affects < 2.0.4 Patched in 2.0.4
  55. Patched Medium · 6.1 Ultimate Member <= 2.0.3 - Cross Site Scripting ↗
    2019-08-12 CVE-2018-20965 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.3 Patched in 2.0.4
  56. Patched Medium · 6.4 Ultimate Member <= 2.0.53 - Cross-Site Scripting ↗
    2019-07-22 CVE-2019-14945 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.53 Patched in 2.0.54
  57. Patched Medium · 5.4 Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting ↗
    2019-06-24 CVE-2019-14947 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.51 Patched in 2.0.52
  58. Patched Medium · 6.1 Ultimate Member <= 2.0.51 - Cross-Site Request Forgery and Stored Cross-Site Scripting ↗
    2019-06-24 CVE-2019-14946 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.51 Patched in 2.0.52
  59. Patched Medium · 4.3 Ultimate Member <= 2.0.39 - Unauthorized Profile Modification ↗
    2019-06-15 CVE-2019-10271 Missing Authorization Affects <= 2.0.39 Patched in 2.0.40
  60. Patched High · 8.8 Ultimate Member <= 2.0.39 - Privilege Escalation ↗
    2019-06-15 CVE-2019-10270 Improper Privilege Management Affects <= 2.0.39 Patched in 2.0.40
  61. Patched Medium · 5.5 Ultimate Member <= 2.0.45 - Admin+ Stored Cross-Site Scripting ↗
    2019-05-13 Improper Neutralization of Input During Web Page Generation Affects < 2.0.46 Patched in 2.0.46
  62. Patched Critical · 9.4 Ultimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.0.45 - Arbitrary File Deletion/Read ↗
    2019-05-13 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.0.45 Patched in 2.0.46
  63. Patched Medium · 6.4 Ultimate Member <= 2.0.45 - Low-Privileged Stored Cross-Site Scripting ↗
    2019-05-13 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.45 Patched in 2.0.46
  64. Patched High · 8.8 Ultimate Member <= 2.0.39 - Cross-Site Request Forgery ↗
    2019-04-01 CVE-2019-10673 Cross-Site Request Forgery Affects < 2.0.40 Patched in 2.0.40
  65. Patched Medium · 6.1 Ultimate Member <= 2.0.32 - Cross-Site Request Forgery ↗
    2018-11-27 Cross-Site Request Forgery Affects <= 2.0.32 Patched in 2.0.33
  66. Patched Medium · 6.1 Ultimate Member <= 2.0.27 - Multiple Cross-Site Scripting vulnerabilities ↗
    2018-10-06 CVE-2018-17866 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.27 Patched in 2.0.28
  67. Patched Medium · 6.1 Ultimate Member <= 2.0.21 - Cross-Site Scripting ↗
    2018-08-09 Improper Neutralization of Input During Web Page Generation Affects < 2.0.22 Patched in 2.0.22
  68. Patched High · 8.8 Ultimate Member <= 2.0.21 - Arbitrary File Upload ↗
    2018-08-08 Unrestricted Upload of File with Dangerous Type Affects < 2.0.22 Patched in 2.0.22
  69. Patched Medium · 6.1 Ultimate Member <= 2.0.17 - Authenticated Cross-Site Scripting ↗
    2018-07-03 CVE-2018-13136 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.17 Patched in 2.0.18
  70. Patched Medium · 4.3 Ultimate Member <= 2.0.3 - Improper Access Control ↗
    2018-05-14 CVE-2018-0589 Improper Access Control Affects <= 2.0.3 Patched in 2.0.4
  71. Patched Medium · 4.3 Ultimate Member < 2.0.4 - Insecure Direct Object Reference ↗
    2018-05-10 CVE-2018-0590 Authorization Bypass Through User-Controlled Key Affects < 2.0.4 Patched in 2.0.4
  72. Patched Medium · 4.3 Ultimate Member <= 2.0.39 - Directory Traversal ↗
    2018-05-10 CVE-2018-0588 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.0.39 Patched in 2.0.40
  73. Patched Medium · 4.3 Ultimate Member < 2.0.4 - Authenticated Unrestricted File Upload ↗
    2018-05-10 CVE-2018-0587 Unrestricted Upload of File with Dangerous Type Affects < 2.0.4 Patched in 2.0.4
  74. Patched Medium · 5.5 Ultimate Member <= 2.0.10 - Authenticated Cross-Site Scripting ↗
    2018-04-23 CVE-2018-10234 Improper Neutralization of Input During Web Page Generation Affects < 2.0.11 Patched in 2.0.11
  75. Patched High · 8.8 Ultimate Member <= 2.0.6 - Multiple Cross-Site Request Forgery Issues ↗
    2018-04-23 CVE-2018-10233 Cross-Site Request Forgery Affects < 2.0.7 Patched in 2.0.7
  76. Patched Medium · 6.1 Ultimate Member <= 2.0.3 - Cross-Site Scripting ↗
    2018-02-14 CVE-2018-6943 Improper Neutralization of Input During Web Page Generation Affects < 2.0.4 Patched in 2.0.4
  77. Patched Medium · 6.1 Ultimate Member <= 2.0 - Cross-Site Scripting ↗
    2018-02-14 CVE-2018-6944 Improper Neutralization of Input During Web Page Generation Affects <= 2.0 Patched in 2.0.4
  78. Patched Critical · 9.8 Ultimate Member <= 1.3.83 - Shortcode Injection ↗
    2017-04-17 Missing Authorization Affects <= 1.3.83 Patched in 1.3.84
  79. Patched Critical · 9.8 Ultimate Member <= 1.3.75 - Missing Authorization to Password Reset ↗
    2016-12-06 Missing Authorization Affects <= 1.3.75 Patched in 1.3.76
  80. Patched Critical · 9.1 Ultimate Member <= 1.3.64 - Local File Inclusion ↗
    2016-07-10 Improper Control of Filename for Include/Require Statement in PHP Program Affects < 1.3.65 Patched in 1.3.65
  81. Patched Medium · 6.1 Ultimate Member <= 1.3.39 - Cross-Site Scripting ↗
    2016-04-06 CVE-2016-10872 Improper Neutralization of Input During Web Page Generation Affects < 1.3.40 Patched in 1.3.40
  82. Patched Medium · 6.1 Ultimate Member <= 1.3.28 - Reflected Cross-Site Scripting ↗
    2015-12-02 CVE-2015-8354 Improper Neutralization of Input During Web Page Generation Affects < 1.3.29 Patched in 1.3.29
  83. Patched Medium · 6.1 Ultimate Member <= 1.3.17 - Cross-Site Scripting ↗
    2015-08-20 CVE-2015-9304 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.17 Patched in 1.3.18
  84. Patched High · 7.1 Ultimate Member 1.2.98 - 1.2.997 - Reflected Cross-Site Scripting ↗
    2015-06-18 Improper Neutralization of Input During Web Page Generation Affects 1.2.98 - 1.2.997 Patched in 1.3.0
  85. Patched Critical · 9.8 Ultimate Member < 1.0.84 - Authorization Bypass to Arbitrary File Upload/Delete ↗
    2015-03-10 Missing Authorization Affects < 1.0.84 Patched in 1.0.84

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Languages

via translate.wordpress.org

Translated into 50 languages, 12 at 90% or more

Dutch 100%
Dutch (Formal) 100%
German (Formal) 100%
French (France) 99%
Galician 99%
German 99%
Korean 99%
Lao 99%
Serbian 99%
Ukrainian 99%
Spanish (Chile) 93%
Spanish (Spain) 91%
Norwegian (Bokmål) 87%
Turkish 85%
Persian 77%
Russian 71%
Danish 69%
Dutch (Belgium) 68%
Swedish 68%
Arabic 66%
Spanish (Ecuador) 66%
Chinese (China) 65%
Czech 64%
Spanish (Colombia) 63%

Plus 26 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names Ultimate Member when asked about these topics, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.

Assistants
ChatGPT, Claude
Topics tracked
Membership, Instagram feed
Get early access to Premium →

Readme readiness

7 of 8 pass · checked 25 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ! Says what it does Short description names no action; say what the plugin does for the site.
  • ✓ Has a FAQ 8 questions in the FAQ.
  • ✓ FAQ asks real questions 8 of 8 read like questions a user would type.
  • ✓ Names who it is for Names its audience or use cases ("designed for", "built for").
  • ✓ Names what it works with Mentions WooCommerce, Elementor, Beaver Builder, Mailchimp and 7 more.
  • ✓ Headings and lists 10 headings and 3 lists.
  • ✓ Enough to quote 5,658 characters of description.
  • ✓ Tags match the text All 5 tags appear in the text.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2021-02-01 100K+ → 200K+ up after 976 days in tier
  2. 2018-06-01 90K+ → 100K+ up after 31 days in tier
  3. 2018-05-01 100K+ → 90K+ down after 30 days in tier
  4. 2018-04-01 90K+ → 100K+ up after 31 days in tier
  5. 2018-03-01 80K+ → 90K+ up after 102 days in tier
  6. 2017-11-19 70K+ → 80K+ up after 61 days in tier
  7. 2017-09-19 60K+ → 70K+ up after 80 days in tier
  8. 2017-07-01 50K+ → 60K+ up after 91 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/ultimate-member" width="480" height="300" style="border:0" loading="lazy" title="Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — Plugin Pulse"></iframe>
Preview card ↗

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin: 200K+ active installs, 4.4★ (1,445 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/ultimate-member

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.