Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

Added: Server-side validation when the Search Form is submitted.

Added: Action hook um_approve_user_on_email_confirmation to natively approve the user after validating the email activation link.

Added: JS filter wp.hook um_member_directory_popstate_ignore to stop window.pushSate in the member directory for 3rd-party integrations.

Server-side validation when the Search Form is submitted.

Action hook um_approve_user_on_email_confirmation to natively approve the user after validating the email activation link.

JS filter wp.hook um_member_directory_popstate_ignore to stop window.pushSate in the member directory for 3rd-party integrations.

Fixed: Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It’s still allowed to use only predefined ‘user_description’ tags in wp_kses().

Fixed: Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.

Fixed: Profile photo dropdown menu position for screens smaller than 340px.

Fixed: Display of the saved value of the “Privacy Options” > “Allowed roles” setting for the member directory.

Fixed: Information in Site-Health about the registration form’s Template and Role settings.

Fixed: Information in Site-Health about the login and profile form’s Template settings.

Security issue, CVE ID: CVE-2025-15064. Deprecated the ability to use HTML inside the user description. It’s still allowed to use only predefined ‘user_description’ tags in wp_kses().

Security issue, CVE ID: CVE-2026-1404. Modified template item formatting to avoid using HTML characters in the filter values.

Profile photo dropdown menu position for screens smaller than 340px.

Display of the saved value of the “Privacy Options” > “Allowed roles” setting for the member directory.

Information in Site-Health about the registration form’s Template and Role settings.

Information in Site-Health about the login and profile form’s Template settings.

members.php

searchform.php

members.php

searchform.php

Added: ‘Privacy Options’ for Member Directory. ‘Who can see this member directory’ and ‘Allowed Roles’.

Added: ‘Rate Limit’ setting for nopriv AJAX actions.

‘Privacy Options’ for Member Directory. ‘Who can see this member directory’ and ‘Allowed Roles’.

‘Rate Limit’ setting for nopriv AJAX actions.

Fixed: Security issue CVE ID: CVE-2025-13220. Used shortcode_atts() function to avoid using wrong attributes.

Fixed: Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.

Fixed: Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.

Fixed: Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.

Security issue CVE ID: CVE-2025-13220. Used shortcode_atts() function to avoid using wrong attributes.

Security issue CVE ID: CVE-2025-13217. Implementing proper input sanitization and escaping for iframe URLs in YouTube, Vimeo, and Google Maps embeds.

Security issue CVE ID: CVE-2025-14081. Filtering fields based on user permissions during Account form submission.

Security issue CVE ID: CVE-2025-12492. Added directory privacy settings and added rate limiting.

members.php

members-grid.php

members-list.php

members.php

members-grid.php

members-list.php

Added: Extra condition for checking the license activation requests.

Added: 2nd $args attribute to the action hook ‘um_cover_area_content’.

Added: $args and $user_id attributes to the action hook ‘um_after_profile_header_name’.

Added: Class um-profile-subnav-{$subnav_id}-link to the sub navigation links in the User Profile page.

Tweak: Updated Extensions_Updater class to use Action Scheduler in the upgrade process of the UM extensions.

Extra condition for checking the license activation requests.

2nd $args attribute to the action hook ‘um_cover_area_content’.

$args and $user_id attributes to the action hook ‘um_after_profile_header_name’.

Class um-profile-subnav-{$subnav_id}-link to the sub navigation links in the User Profile page.

Updated Extensions_Updater class to use Action Scheduler in the upgrade process of the UM extensions.

Fixed: User profile links in the comments section on the frontend when the $comment->user_id is empty.

Fixed: The emotize function regexp for better emoji converting.

Fixed: The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.

Fixed: PHP warnings for roles without meta data.

Fixed: Typo in labels.

User profile links in the comments section on the frontend when the $comment->user_id is empty.

The emotize function regexp for better emoji converting.

The conflict between the image uploader and lazy-loading attribute added by 3rd-party plugins.

PHP warnings for roles without meta data.

Typo in labels.