GPLCoffee
Get Started
Ultimate Member icon

11 versions

Ultimate Member history.

Every release of Ultimate Member is archived here with its changelog, file size, and security scan result. Use the archive to roll back to a stable release or audit what changed between updates.

8 of 11 releases scanned clean
v2.14.1Latest
October 23, 20263.7 MBScanned
Other
  • *Bugfixes**
Fixed
  • CVE-2026-107625 security issue. Added confirmation prompt for external links and improve localization support in frontend scripts. (Reported by Wordfence).
  • Reading the icons' list via `UM()->setup()->get_icons_list()`. This function provides a static in-memory fallback if the DB option is missing or unreadable.
v2.14.0
September 29, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • profile/comments.php
  • profile/posts.php
  • login.php
  • members.php
  • profile.php
  • register.php
  • *Deprecated**
  • Marked as deprecate soon: `in_group` attribute for the fields in the UM Forms builder.
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • `$form_id` parameter to the action hooks `um_before_form`, `um_before_{$mode}_fields`, `um_main_{$mode}_fields`, `um_after_form_fields`, `um_after_{$mode}_fields` and `um_after_form`.
  • Action hook `um_before_render_dynamic_modal_content` for 3rd-party integration when the admin popup is opened.
  • Filter hooks `um_email_validation_real_error_codes` and `um_email_validation_error_message` for 3rd-party integration to change or make visible the real error message for email fields validation.
  • Threads field support in the UM Forms and Social Icons meta-row.
Fixed
  • Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added `um_maybe_unserialize()` function.
  • Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory.
  • Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests.
  • CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence).
  • CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence).
  • Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)).
  • `is_url()` validation for the social links fields.
  • `unique_email` validation. Parse primary and secondary email fields to make the email unique between them.
Removed
  • `UM()->check_ajax_nonce` and `UM()->admin()->check_ajax_nonce()` functions. Use WordPress native `wp_verify_nonce()`, `check_admin_referer()` and `check_ajax_referer()` instead with unique nonce field values. Left them now for backward compatibility.
  • Using `um_admin_scripts.nonce` and `um_scripts.nonce` localized data in UM scripts. Left them still localized for backward compatibility.
  • JS common action for `'.um-ajax-action'` class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for `um_muted_action`.
  • Action hook `um_run_ajax_function__{$hook}` used in the `um_muted_action` handler.
v2.13.1
September 15, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Deprecated**
Added
  • Fallback for `wp-cli/wp-config-transformer` library if the wp-config.php file isn't writable.
  • Filter hook `um_members_directory_filter_text` 3rd parameter `$is_default` to check if it's admin filtering or frontend query.
  • 'Administrative capabilities ban' option enabled by default after the first installation.
Improved
  • Slow SQL query for batch empty account status check.
  • Redundant SQL calls when editing the Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad).
Fixed
  • Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed `um_convert_tags()` function and applied the escapers throughout the placeholder replacement.
  • Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad).
  • "Can user edit this field?" field setting displaying only for the User Profile form fields.
  • Getting the pages list in the wp-admin UM > Settings > General > Pages section.
  • Displaying the field-type time on the User Profile page.
  • Using `illegal_user_logins` for the current admin user with the username specified in the illegal user logins list.
Removed
  • Filter hook `um_members_directory_filter_text_meta_value` is fully deprecated, replacement isn't required for the text-type filter field.
v2.13.0Unavailable
August 24, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • gdpr-register.php
  • profile.php
  • *Deprecated**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
  • Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
  • New user-capabilities functions `UM()->common()->users()->can_view_user()`, `UM()->common()->users()->get_privacy_setting()`, `UM()->common()->users()->is_user_profile_private()`, `UM()->common()->users()->get_restricted_privacy_notice()`, `UM()->common()->users()->can_view_private_user_profile()`, `UM()->common()->users()->can_view_user_profile()`. The future replacement for the `um_can_view_profile()` helper with different cases to check.
Improved
  • Version of the WordPress native excluded functions to avoid the using them in the callbacks.
Fixed
  • `WP_Filesystem()` initialization optimization. Init `WP_Filesystem()` only once when it's necessary.
  • Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
  • Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
  • Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
  • Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
  • Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
  • Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
  • Member Directory type-button styles.
  • Added fallback for the date and time fields to show date and time using the WordPress native format.
Removed
  • Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native ` ` and ` ` instead.
v2.12.1
July 6, 20263.7 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Ability to handle local website URLs resources (image, audio, video from Media Library, 3rd-party local URLs embed to iframe) in the oEmbed-type field value.
  • The API key field type for the settings fields.
Fixed
  • Security issue, CVE ID: CVE-2026-4248. Extern blacklist filter for convert_tag replace placeholders function. (Additional keys were researched by Hrro. This info added for the Wordfence team if they need this information).
  • Security issue when accidentally `manage_options` level user role can be listed in the User Role dropdown on the registration/edit profile forms. (Researched by Haitam Lazaar).
  • Set size proportions during responsive handlers.
  • mousewheel action during member directory loading and overlay is displayed.
  • WP_Styles notice due to not loaded `um_modal` styles.
  • oEmbed-type field styles.
v2.12.0Unavailable
June 12, 20263.7 MB
Other
  • *Bugfixes**
  • * Restricted `get_directory_by_hash()` function to only match posts with post_type='um_directory' and publish post status.
  • * Used `0 =
Fixed
  • Security issue, CVE ID: CVE-2026-7761.
v2.11.4
May 1, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Checking format of the 3rd-party registered custom fields. Avoid PHP errors related to the wrong format or unexpected attributes.
Fixed
  • Added uploader fields `accept` argument for set allowed mime-types in the upload dialog window. Updated 3.1.2 version of this library [hayageek/jquery-upload-file](https://github.com/hayageek/jquery-upload-file/). Don't use 4.0.11 version for now.
  • JS initialization of the empty uploader fields.
  • User Profile URLs in the User Profile form on the not-predefined pages placed via shortcode.
v2.11.3Unavailable
March 28, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • message.php
  • restricted-blog.php
  • restricted-taxonomy.php
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • UM > Settings > Advanced > APIs section for set available APIs settings.
  • GoogleMaps API setting when it's available.
  • Function `UM()->mail()->enabled_email()` for checking if the email notification is enabled by the user.
  • `color` type of sanitize settings saved in wp-admin.
  • Checking array type of submission data when `url` type of sanitize is used in wp-admin.
  • Enhance UM form sanitization filter with $form_data param. Added the $form_data parameter to the `um_sanitize_form_submission` filter.
  • Option for special character requirement for passwords. It's situated in "General > Users > Password requires special character" (based on @faisalahammad suggestions)
  • Filter hook `um_before_account_delete_text` for changing before delete account text by 3rd-party plugins. End-customers can use it for translations.
  • Filter hook `um_custom_{$message_key}` (`um_custom_pending_message`, `um_custom_checkmail_message`) for changing after-registration message based on the user status by 3rd-party plugins. End-customers can use it for translations.
  • Filter hook `um_convert_tags_blacklist_fields` For 3rd-party integrations to control the usermeta keys in `um_convert_tags()` function.
  • `.um-display-none` CSS utility + `umShow()/umHide()/umToggle()` jQuery helpers.
  • `um-notice` JS library.
Fixed
  • Security issue, CVE ID: CVE-2026-4248. Added blacklist filter for convert_tag replace placeholders function.
  • HTML sanitization logic for textarea-type custom fields with enabled HTML using setting.
  • WP editor formatting to prevent incorrect HTML entity conversion when using html-mode in the textarea-type custom fields. Applied and removed this filter dynamically to avoid interfering with other processes.
  • Dynamic string translation pattern and improve escaping. Replaced incorrect __('%s') pattern. (@faisalahammad)
  • `wp_die()` function triggering on the frontend actions. Added UM notice above the User Profile page. (based on @faisalahammad suggestions)
  • Password reset key handling for multiple users. Previously, the static reset key caused issues when handling password resets for multiple users simultaneously.
  • `um_trim_string()` function for using with UTF-8 symbols.
  • PHP Notice: Function WP_Scripts::add was called incorrectly.
v2.11.2Unavailable
February 12, 20263.6 MBScanned
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • searchform.php
  • *Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade**
Added
  • Server-side validation when the Search Form is submitted.
  • Action hook `um_approve_user_on_email_confirmation` to natively approve the user after validating the email activation link.
  • JS filter wp.hook `um_member_directory_popstate_ignore` to stop window.pushSate in the member directory for 3rd-party integrations.
Fixed
  • Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It's still allowed to use only predefined 'user_description' tags in `wp_kses()`.
  • Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.
  • Profile photo dropdown menu position for screens smaller than 340px.
  • Display of the saved value of the "Privacy Options" > "Allowed roles" setting for the member directory.
  • Information in Site-Health about the registration form's `Template` and `Role` settings.
  • Information in Site-Health about the login and profile form's `Template` settings.
v2.11.1Unavailable
December 24, 20253.6 MBUnknown
Other
  • *Enhancements**
  • *Bugfixes**
  • *Templates Requiring Update**
  • members.php
  • members-grid.php
  • members-list.php
Added
  • 'Privacy Options' for Member Directory. 'Who can see this member directory' and 'Allowed Roles'.
  • 'Rate Limit' setting for nopriv AJAX actions.
Fixed
  • Security issue CVE ID: CVE-2025-13220. Used `shortcode_atts()` function to avoid using wrong attributes.
  • Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.
  • Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.
  • Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.

Why archive

Sometimes the latest release isn't the one you need. The archive lets you pin Ultimate Member to a known-good version, or roll back while a bug is investigated. Every release stays scanned and reachable.