Skip to content
PluginCanary

Ultimate Member

Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
by Ultimate Member · 200,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (53 of 100).

78/ 100 Canary Score
Sub-scores for Ultimate Member
Ownership100
Maintenance100
Security60
Support53
Reputation70

How the score works

Quick answers

Is Ultimate Member still maintained?
Yes. Last release 2 Nov 2026, 22 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns Ultimate Member, and has it changed hands?
No change recorded. Main committer nsinelnikov since Sep 2017. 4 Nov 2026 · SVN log
Was Ultimate Member removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Ultimate Member safe?
86 known vulnerabilities, all fixed (latest in 2.14.1). Not on the exploited list. 27 Oct 2026 · Wordfence Intelligence
Is the latest Ultimate Member update safe to install?
No ownership change before 2.14.2. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
nsinelnikov18 Sep 2017 to 2 Nov 2026, 221 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
2 days ago
Releases, 24 months
22
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter
Releases per quarter for Ultimate Member
Q1 20243
Q2 20242
Q3 20240
Q4 20245
Q1 20253
Q2 20254
Q3 20250
Q4 20253
Q1 20262
Q2 20262
Q3 20264
Q4 20262

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 1.0 (2 reviews). Lifetime: 4.4.

Average rating per quarter for Ultimate Member
Q3 20244.0
Q4 20244.5
Q1 20252.5
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20261.0
Q2 20261.0
Q3 20261.0
Q4 20261.0

Average rating fell from 4.0 to 1.0 between Q3 2024 and Q4 2026.

Rating distribution
5 star1138
4 star69
3 star38
2 star46
1 star154
Latest low reviews

Security record

29 vulnerabilities in 24 months (86 on record), all patched (latest fixed in 2.14.1).

Show 86 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
27 Oct 2026Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field6.4<= 2.14.02.14.1Patched before disclosure
26 Oct 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated PHP Object Injection8.1<= 2.13.12.14.0Patched before disclosure
2 Oct 2026Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass7.5<= 2.13.12.14.0Patched before disclosure
2 Oct 2026Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter7.2<= 2.13.12.14.0Patched before disclosure
2 Oct 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Unauthenticated Privilege Escalation7.3<= 2.13.12.14.0Patched before disclosure
1 Oct 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Subscriber+) Privilege Escalation6.3<= 2.13.12.14.0Patched before disclosure
1 Oct 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.13.1 - Authenticated (Administrator+) SQL Injection4.9<= 2.13.12.14.0Patched before disclosure
17 Sep 2026Ultimate Member <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting7.2<= 2.13.02.13.1Patched before disclosure
31 Aug 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.13.0 - Unauthenticated Unapproved Comment and Private Profile Data Disclosure5.3< 2.13.02.13.0Patched before disclosure
28 Aug 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation7.32.6.7 to 2.12.12.13.0Patched before disclosure
24 Aug 2026Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)6.4<= 2.12.12.13.0Patched before disclosure
5 Aug 2026Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin < 2.12.1 - Unauthenticated Privilege Escalation7.3< 2.12.12.12.1Patched before disclosure
2 Jul 2026Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field6.4<= 2.11.42.12.0Patched before disclosure
23 Jun 2026Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure8.8<= 2.11.42.12.0Patched before disclosure
15 Jun 2026Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 2.11.02.12.0Patched before disclosure
3 Apr 2026Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets6.4<= 2.11.12.11.2Patched before disclosure
27 Mar 2026Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag8<= 2.11.22.11.3Patched before disclosure
17 Feb 2026Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters6.1<= 2.11.12.11.2Patched before disclosure
20 Dec 2025Ultimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4<= 2.11.02.11.1Patched before disclosure
19 Dec 2025Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure5.3<= 2.11.02.11.1Patched before disclosure
16 Dec 2025Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'6.4<= 2.11.02.11.11
16 Dec 2025Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Profile Privacy Setting Bypass4.3<= 2.11.02.11.11
7 May 2025Ultimate Member <= 2.10.3 - Authenticated (Administrator+) Arbitrary Function Call7.2<= 2.10.32.10.48
16 Apr 2025Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection7.5<= 2.10.12.10.2Patched before disclosure
4 Mar 2025Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter7.5<= 2.10.02.10.1Patched before disclosure

Changelog mentions of security fixes: 2.12.0 (security); 2.12.1 (security); 2.13.0 (security, nonce, sanitize); 2.13.1 (security); 2.14.0 (security, vulnerability, SQL injection, nonce, sanitize).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

53% of 43 support threads resolved in the last 2 months.

Momentum

200,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ultimate Member
4 May 20268,945
11 May 202614,519
18 May 202619,188
25 May 202611,039
1 Jun 20268,941
8 Jun 202673,345
15 Jun 202622,973
22 Jun 202618,844
29 Jun 202612,559
6 Jul 202689,521
13 Jul 202617,665
20 Jul 202613,188
27 Jul 202610,866
3 Aug 202613,142
10 Aug 202610,619
17 Aug 20267,490
24 Aug 202688,059
31 Aug 202617,779
7 Sep 202610,806
14 Sep 202690,781
21 Sep 202622,533
28 Sep 202684,586
5 Oct 202626,991
12 Oct 202611,211
19 Oct 202677,229
26 Oct 202637,491
2 Nov 20263,357

Weekly downloads over the last 4 weeks are 6% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Gravatar EnhancedScore 100 · 100,000+LoginWP (Formerly Peter's LoginScore 92 · 80,000+Simple User AvatarScore 92 · 20,000+WP User AvatarsScore 91 · 20,000+One User AvatarScore 89 · 100,000+

Facts

Version2.14.2
AuthorUltimate Member
Added21 Jan 2015
Last updated2 Nov 2026
Active installs200,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.0
CategoryCommunity & Social > Membership Sites & Subscriptions
Tagsmember, community, membership, user profile, User Registration

Other plugins by this author: JobBoardWP - Job Board Listings and Submissions, ForumWP - Forum & Discussion Board

Questions

Is Ultimate Member still maintained?

Yes. Last release 2 Nov 2026, 22 releases in the last 24 months.

Who owns Ultimate Member, and has it changed hands?

No change recorded. Main committer nsinelnikov since Sep 2017.

Was Ultimate Member removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Ultimate Member safe?

86 known vulnerabilities, all fixed (latest in 2.14.1). Not on the exploited list.

Is the latest Ultimate Member update safe to install?

No ownership change before 2.14.2. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue