GPLCoffee
GPLCoffee
Get Started
Ultimate Member icon

8 versions

Ultimate Member history.

Every release of Ultimate Member is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.

5 of 8 releases scanned clean
v2.13.0Latest
August 24, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • gdpr-register.php
  • profile.php
  • *Deprecated**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
  • Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
  • New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check.
Improved
  • Version of the WordPress native excluded functions to avoid the using them in the callbacks.
Fixed
  • `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary.
  • Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
  • Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
  • Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
  • Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
  • Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
  • Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
  • Member Directory type-button styles.
  • Added fallback for the date and time fields to show date and time using the WordPress native format.
Removed
  • Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native ` ` and ` ` instead.
v2.12.1
July 6, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
  • The API key field type for the settings fields.
Fixed
  • Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
  • Security issue when accidentally `manage_options` level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
  • Set size proportions during responsive handlers.
  • mousewheel action during member directory loading and overlay is displayed.
  • WP_Styles notice due to not loaded `um_modal` styles.
  • oEmbed-type field styles.
v2.12.0
June 12, 20263.7 MB
Other
  • *Bugfixes**
  • * Restricted `get_directory_by_hash()` function to only match posts with post_type='um_directory' and publish post status.
  • * Used `0 =
Fixed
  • Security issue, CVE ID: CVE-2026-7761.
v2.11.4
May 1, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Checking format of the 3rd-party registered custom fields. Avoid PHP errors related to the wrong format or unexpected attributes.
Fixed
  • Added uploader fields `accept` argument for set allowed mime-types in the upload dialog window. Updated 3.1.2 version of this library [hayageek/jquery-upload-file](https://github.com/hayageek/jquery-upload-file/). Don't use 4.0.11 version for now.
  • JS initialization of the empty uploader fields.
  • User Profile URLs in the User Profile form on the not-predefined pages placed via shortcode.
v2.11.3Unavailable
March 28, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • message.php
  • restricted-blog.php
  • restricted-taxonomy.php
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • UM > Settings > Advanced > APIs section for set available APIs settings.
  • GoogleMaps API setting when it's available.
  • Function `UM()->mail()->enabled_email()` for checking if the email notification is enabled by the user.
  • `color` type of sanitize settings saved in wp-admin.
  • Checking array type of submission data when `url` type of sanitize is used in wp-admin.
  • Enhance UM form sanitization filter with $form_data param. Added the $form_data parameter to the `um_sanitize_form_submission` filter.
  • Option for special character requirement for passwords. It's situated in "General > Users > Password requires special character" (based on @faisalahammad suggestions)
  • Filter hook `um_before_account_delete_text` for changing before delete account text by 3rd-party plugins. End-customers can use it for translations.
  • Filter hook `um_custom_{$message_key}` (`um_custom_pending_message`, `um_custom_checkmail_message`) for changing after-registration message based on the user status by 3rd-party plugins. End-customers can use it for translations.
  • Filter hook `um_convert_tags_blacklist_fields` For 3rd-party integrations to control the usermeta keys in `um_convert_tags()` function.
  • `.um-display-none` CSS utility + `umShow()/umHide()/umToggle()` jQuery helpers.
  • `um-notice` JS library.
Fixed
  • Security issue, CVE ID: CVE-2026-4248. Added blacklist filter for convert_tag replace placeholders function.
  • HTML sanitization logic for textarea-type custom fields with enabled HTML using setting.
  • WP editor formatting to prevent incorrect HTML entity conversion when using html-mode in the textarea-type custom fields. Applied and removed this filter dynamically to avoid interfering with other processes.
  • Dynamic string translation pattern and improve escaping. Replaced incorrect __('%s') pattern. (@faisalahammad)
  • `wp_die()` function triggering on the frontend actions. Added UM notice above the User Profile page. (based on @faisalahammad suggestions)
  • Password reset key handling for multiple users. Previously, the static reset key caused issues when handling password resets for multiple users simultaneously.
  • `um_trim_string()` function for using with UTF-8 symbols.
  • PHP Notice: Function WP_Scripts::add was called incorrectly.
v2.11.2Unavailable
February 12, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • searchform.php
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Server-side validation when the Search Form is submitted.
  • Action hook `um_approve_user_on_email_confirmation` to natively approve the user after validating the email activation link.
  • JS filter wp.hook `um_member_directory_popstate_ignore` to stop window.pushSate in the member directory for 3rd-party integrations.
Fixed
  • Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
  • Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
  • Profile photo dropdown menu position for screens smaller than 340px.
  • Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
  • Information in Site-Health about the registration form's `Template` and `Role` settings.
  • Information in Site-Health about the login and profile form's `Template` settings.
v2.11.1Unavailable
December 24, 20253.6 MBUnknown
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • members-grid.php
  • members-list.php
Added
  • 'Privacy Options' for Member Directory. 'Who can see this member directory' and 'Allowed Roles'.
  • 'Rate Limit' setting for nopriv AJAX actions.
Fixed
  • Security issue CVE ID: CVE-2025-13220. Used `shortcode_atts()` function to avoid using wrong attributes.
  • Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.
  • Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.
  • Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.
v2.11.0Unavailable
December 24, 20253.6 MB
Other
  • *Enhancements**
  • *Bugfixes**
  • [See changelog for all versions](https://plugins.svn.wordpress.org/ultimate-member/trunk/changelog.txt).
Added
  • Extra condition for checking the license activation requests.
  • 2nd `$args` attribute to the action hook 'um_cover_area_content'.
  • `$args` and `$user_id` attributes to the action hook 'um_after_profile_header_name'.
  • Class `um-profile-subnav-{$subnav_id}-link` to the sub navigation links in the User Profile page.
Improved
  • Updated `Extensions_Updater` class to use Action Scheduler in the upgrade process of the UM extensions.
Fixed
  • User profile links in the comments section on the frontend when the `$comment->user_id` is empty.
  • The `emotize` function regexp for better emoji converting.
  • The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.
  • PHP warnings for roles without meta data.
  • Typo in labels.

Why archive

Sometimes the latest release isn't the one you need. The archive lets you pin Ultimate Member to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.