* fixed #1436;

includes/core/class-shortcodes.php

@@ -672,6 +672,22 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 			$args['form_id']  = ! empty( $args['form_id'] ) ? absint( $args['form_id'] ) : '';
 			$args['is_block'] = (bool) $args['is_block'];
 
+			$form_post = get_post( $args['form_id'] );
+			// Invalid post ID. Maybe post doesn't exist.
+			if ( empty( $form_post ) ) {
+				return '';
+			}
+
+			// Invalid post type. It can be only `um_form` or `um_directory`
+			$post_types = array( 'um_form' );
+			if ( UM()->options()->get( 'members_page' ) ) {
+				$post_types[] = 'um_directory';
+			}
+
+			if ( ! in_array( $form_post->post_type, $post_types, true ) ) {
+				return '';
+			}
+
 			/**
 			 * Filters variable for enable singleton shortcode loading on the same page.
 			 * Note: Set it to `false` if you don't need to render the same form twice or more on the same page.

readme.txt

@@ -190,6 +190,8 @@ IMPORTANT: PLEASE UPDATE THE PLUGIN TO AT LEAST VERSION 2.6.7 IMMEDIATELY. VERSI
 * Fixed: Email changing via User Account flush session. Security enhancement because email can be used for login
 * Fixed: User Profile image URL in meta tags
 * Fixed: Empty User Profile and PHP Fatal error when cannot get profile field data
+* Fixed: Parsing /modal/ templates and parsing templates on the Windows hosting
+* Fixed: Validation `form_id` attribute in the `ultimatemember` shortcode
 
 **Templates required update**