7 versions
Ultimate Member history.
Every release of Ultimate Member is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.
4 of 7 releases scanned clean
v2.12.1Latest
July 6, 20263.7 MBScanned
Other
- *Enhancements**
- *Bugfixes**
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
- The API key field type for the settings fields.
Fixed
- Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
- Security issue when accidentally `manage_options` level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
- Set size proportions during responsive handlers.
- mousewheel action during member directory loading and overlay is displayed.
- WP_Styles notice due to not loaded `um_modal` styles.
- oEmbed-type field styles.
May 1, 20263.6 MBScanned
Other
- *Enhancements**
- *Bugfixes**
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Checking format of the 3rd-party registered custom fields. Avoid PHP errors related to the wrong format or unexpected attributes.
Fixed
- Added uploader fields `accept` argument for set allowed mime-types in the upload dialog window. Updated 3.1.2 version of this library [hayageek/jquery-upload-file](https://github.com/hayageek/jquery-upload-file/). Don't use 4.0.11 version for now.
- JS initialization of the empty uploader fields.
- User Profile URLs in the User Profile form on the not-predefined pages placed via shortcode.
v2.11.3Unavailable
March 28, 20263.6 MBScanned
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- members.php
- message.php
- restricted-blog.php
- restricted-taxonomy.php
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- UM > Settings > Advanced > APIs section for set available APIs settings.
- GoogleMaps API setting when it's available.
- Function `UM()->mail()->enabled_email()` for checking if the email notification is enabled by the user.
- `color` type of sanitize settings saved in wp-admin.
- Checking array type of submission data when `url` type of sanitize is used in wp-admin.
- Enhance UM form sanitization filter with $form_data param. Added the $form_data parameter to the `um_sanitize_form_submission` filter.
- Option for special character requirement for passwords. It's situated in "General > Users > Password requires special character" (based on @faisalahammad suggestions)
- Filter hook `um_before_account_delete_text` for changing before delete account text by 3rd-party plugins. End-customers can use it for translations.
- Filter hook `um_custom_{$message_key}` (`um_custom_pending_message`, `um_custom_checkmail_message`) for changing after-registration message based on the user status by 3rd-party plugins. End-customers can use it for translations.
- Filter hook `um_convert_tags_blacklist_fields` For 3rd-party integrations to control the usermeta keys in `um_convert_tags()` function.
- `.um-display-none` CSS utility + `umShow()/umHide()/umToggle()` jQuery helpers.
- `um-notice` JS library.
Fixed
- Security issue, CVE ID: CVE-2026-4248. Added blacklist filter for convert_tag replace placeholders function.
- HTML sanitization logic for textarea-type custom fields with enabled HTML using setting.
- WP editor formatting to prevent incorrect HTML entity conversion when using html-mode in the textarea-type custom fields. Applied and removed this filter dynamically to avoid interfering with other processes.
- Dynamic string translation pattern and improve escaping. Replaced incorrect __('%s') pattern. (@faisalahammad)
- `wp_die()` function triggering on the frontend actions. Added UM notice above the User Profile page. (based on @faisalahammad suggestions)
- Password reset key handling for multiple users. Previously, the static reset key caused issues when handling password resets for multiple users simultaneously.
- `um_trim_string()` function for using with UTF-8 symbols.
- PHP Notice: Function WP_Scripts::add was called incorrectly.
v2.11.2Unavailable
February 12, 20263.6 MBScanned
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- members.php
- searchform.php
- *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
- Server-side validation when the Search Form is submitted.
- Action hook `um_approve_user_on_email_confirmation` to natively approve the user after validating the email activation link.
- JS filter wp.hook `um_member_directory_popstate_ignore` to stop window.pushSate in the member directory for 3rd-party integrations.
Fixed
- Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
- Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
- Profile photo dropdown menu position for screens smaller than 340px.
- Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
- Information in Site-Health about the registration form's `Template` and `Role` settings.
- Information in Site-Health about the login and profile form's `Template` settings.
v2.11.1Unavailable
December 24, 20253.6 MBUnknown
Other
- *Enhancements**
- *Bugfixes**
- *Templates Requiring Update**
- members.php
- members-grid.php
- members-list.php
Added
- 'Privacy Options' for Member Directory. 'Who can see this member directory' and 'Allowed Roles'.
- 'Rate Limit' setting for nopriv AJAX actions.
Fixed
- Security issue CVE ID: CVE-2025-13220. Used `shortcode_atts()` function to avoid using wrong attributes.
- Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.
- Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.
- Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.
v2.11.0Unavailable
December 24, 20253.6 MB
Other
- *Enhancements**
- *Bugfixes**
- [See changelog for all versions](https://plugins.svn.wordpress.org/ultimate-member/trunk/changelog.txt).
Added
- Extra condition for checking the license activation requests.
- 2nd `$args` attribute to the action hook 'um_cover_area_content'.
- `$args` and `$user_id` attributes to the action hook 'um_after_profile_header_name'.
- Class `um-profile-subnav-{$subnav_id}-link` to the sub navigation links in the User Profile page.
Improved
- Updated `Extensions_Updater` class to use Action Scheduler in the upgrade process of the UM extensions.
Fixed
- User profile links in the comments section on the frontend when the `$comment->user_id` is empty.
- The `emotize` function regexp for better emoji converting.
- The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.
- PHP warnings for roles without meta data.
- Typo in labels.
Why archive
Sometimes the latest release isn't the one you need. The archive lets you pin Ultimate Member to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.