Every recorded version, newest first, with what changed in each one.
Latest 2.14.2· Nov 2, 20265 versionsSince Aug 2026
2026 · 5 versions
2.14.2
Latest
3 fixes
Fixed
Bugfixes
CVE-2026-116621 security issue. Used different escapers (`esc_html` or `wp_kses` with `user_input` allowed HTML tags) based on the enabled HTML field option.
Account submission. Typo in variable naming.
2.14.1
3 fixes
Fixed
Bugfixes
CVE-2026-107625 security issue. Added confirmation prompt for external links and improve localization support in frontend scripts. (Reported by Wordfence).
Reading the icons' list via `UM->setup->get_icons_list`. This function provides a static in-memory fallback if the DB option is missing or unreadable.
2.14.0
4 new1 improvement9 fixes5 removed9 changes
New
`$form_id` parameter to the action hooks `um_before_form`, `um_before_{$mode}_fields`, `um_main_{$mode}_fields`, `um_after_form_fields`, `um_after_{$mode}_fields` and `um_after_form`.
Action hook `um_before_render_dynamic_modal_content` for 3rd-party integration when the admin popup is opened.
Filter hooks `um_email_validation_real_error_codes` and `um_email_validation_error_message` for 3rd-party integration to change or make visible the real error message for email fields validation.
Threads field support in the UM Forms and Social Icons meta-row.
Improved
Enhancements
Fixed
Bugfixes
Security issue related to an unauthenticated PHP Object Injection vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added `um_maybe_unserialize` function.
Security issue related to administrator Stored SQL Injection via Directory Search-Field Identifiers. (Reported by Ananda Dhakal (Patchstack)). Added sanitizing for the searching fields in the member directory.
Security issue related to an unauthenticated Improper Enforcement of Behavioral Workflow vulnerability. (Reported by Ananda Dhakal (Patchstack)). Added unique nonce fields and attributes for requests.
CVE-2026-96270 security issue. Added sanitizing for the form_id attribute during the Ultimate Member forms submission. (Reported by Wordfence).
CVE-2026-93428 security issue. Fixed fields privacy when displaying the User Profile fields. (Reported by Wordfence).
Security issue related to Privilege Escalation. Fixed user account submission and nonce security. Reset the user if it hasn't the ability to download the file. (Reported by Intrudify (Patchstack)).
`is_url` validation for the social links fields.
`unique_email` validation. Parse primary and secondary email fields to make the email unique between them.
Removed
Deprecated
`UM->check_ajax_nonce` and `UM->admin->check_ajax_nonce` functions. Use WordPress native `wp_verify_nonce`, `check_admin_referer` and `check_ajax_referer` instead with unique nonce field values. Left them now for backward compatibility.
Using `um_admin_scripts.nonce` and `um_scripts.nonce` localized data in UM scripts. Left them still localized for backward compatibility.
JS common action for `'.um-ajax-action'` class. It's not used anymore in UM core and extensions and can be removed the same as AJAX handler for `um_muted_action`.
Action hook `um_run_ajax_function__{$hook}` used in the `um_muted_action` handler.
Changes
Templates Requiring Update
profile/comments.php
profile/posts.php
login.php
members.php
profile.php
register.php
Marked as deprecate soon: `in_group` attribute for the fields in the UM Forms builder.
Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade
2.13.1
3 new3 improvements7 fixes2 removed
New
Fallback for `wp-cli/wp-config-transformer` library if the wp-config.php file isn't writable.
Filter hook `um_members_directory_filter_text` 3rd parameter `$is_default` to check if it's admin filtering or frontend query.
'Administrative capabilities ban' option enabled by default after the first installation.
Improved
Enhancements
Slow SQL query for batch empty account status check.
Redundant SQL calls when editing the Profile page with callback dropdowns. Cached usermeta existence checks per user and key during a single load (Reported by @MissVeronica, author @faisalahammad).
Fixed
Bugfixes
Security issue related to an unauthenticated visitor can store JavaScript that runs in an administrator's session, through their own profile name. (Reported by Karthik Ramakrishnan and WPScan team). Fixed `um_convert_tags` function and applied the escapers throughout the placeholder replacement.
Using LIKE compare for the text-type filters with custom usermeta table (Reported by @MissVeronica, author @faisalahammad).
"Can user edit this field?" field setting displaying only for the User Profile form fields.
Getting the pages list in the wp-admin UM > Settings > General > Pages section.
Displaying the field-type time on the User Profile page.
Using `illegal_user_logins` for the current admin user with the username specified in the illegal user logins list.
Removed
Deprecated
Filter hook `um_members_directory_filter_text_meta_value` is fully deprecated, replacement isn't required for the text-type filter field.
2.13.0
3 new2 improvements10 fixes2 removed5 changes
New
Using `illegal_user_logins` filter to sanitize the `user_login` field value during registration or upgrade.
Using `wp-cli/wp-config-transformer` library to set Ultimate Member > API keys settings constants in wp-config.php instead of storing them in DB.
New user-capabilities functions `UM->common->users->can_view_user`, `UM->common->users->get_privacy_setting`, `UM->common->users->is_user_profile_private`, `UM->common->users->get_restricted_privacy_notice`, `UM->common->users->can_view_private_user_profile`, `UM->common->users->can_view_user_profile`. The future replacement for the `um_can_view_profile` helper with different cases to check.
Improved
Enhancements
Version of the WordPress native excluded functions to avoid the using them in the callbacks.
Fixed
Bugfixes
`WP_Filesystem` initialization optimization. Init `WP_Filesystem` only once when it's necessary.
Redirect on non-main queries (breaks Spectra and block themes). Added conditional check for the main query (based on @faisalahammad suggestions).
Registration form infinite loop - gdpr-register.php calls `the_content` recursively causing PHP fatal error. Excluded predefined UM pages and pages with [ultimatemember] shortcode from the list, render empty content for such pages if they are already selected to avoid PHP error (based on @faisalahammad suggestions).
Causes site-wide `rest_cookie_invalid_nonce` on all authenticated REST requests. Refactored admin notice handling to enhance security and flexibility. Removed using localized `um_admin_scripts.nonce` globally on wp-admin. It's localized only on UM wp-admin pages. (based on @michaeldavisdcpersonal report and @faisalahammad suggestions).
Security issue when an unauthenticated visitor can read the content of comments awaiting moderation. (Reported by Alessandro Greco (Aleff) and Giovambattista Ianni, University of Calabria (UNICAL)).
Security issue related to an unauthenticated privilege escalation through the profile form role field. (Reported by Jakub Herman).
Security issue, CVE ID: CVE-2026-18547. Used 'user_input' allowed a tag list to sanitize HTML-enabled textarea fields. Deprecated Pickadate.JS and Pickatime.JS libraries for User Forms fields.
Member Directory type-button styles.
Added fallback for the date and time fields to show date and time using the WordPress native format.
Removed
Deprecated
Pickadate.JS and Pickatime.JS libraries for User Forms fields. Used HTML native ` ` and ` ` instead.
Changes
Templates Requiring Update
gdpr-register.php
profile.php
Note: Cached and optimized/minified assets(JS/CSS) must be flushed/re-generated after the upgrade
[See changelog for all versions]
Changelog published by the developer, in their original language.
