← All credits
Kevin Wydler
7 vulnerability records and advisories credit this contributor.
CVE-2025-15064
Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets
CVE-2026-7761
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
CVE-2025-0818
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
CVE-2025-13217
Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'
CVE-2024-2765
Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
CVE-2024-12276
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
CVE-2024-10528
Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update