Mykyta Synelnikov e9abab925f Fix security vulnerability CVE-2025-13220 in Ultimate Member. ...

Addressed CVE-2025-13220 by implementing necessary fixes in the plugin's shortcodes and updating sanitization for shortcode attributes. Removed redundant compatibility checks for WordPress versions earlier than 5.4 and improved stability in the shortcode handling logic.

2025-12-05 17:41:51 +02:00

..

rest

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-access.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-account.php

- fix change email permissions

2025-04-30 12:02:03 +03:00

class-ajax-common.php

* maybe fixed CVE-2024-10528;

2024-11-05 11:55:07 +02:00

class-blocks.php

- fix restrictions for all blocks

2025-06-19 15:30:30 +03:00

class-builtin.php

- fix country name

2025-06-18 11:11:09 +03:00

class-cron.php

Fix invalid 'start_of_week' handling in weekly events logic

2025-09-05 15:24:28 +03:00

class-date-time.php

- finally reviewed #1361;

2023-12-01 12:50:13 +02:00

class-external-integrations.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

class-fields.php

- allow webp image format

2025-09-22 12:48:39 +03:00

class-files.php

- allow webp image format

2025-09-22 12:48:39 +03:00

class-fonticons.php

- FontIcons libraries moving to legacy;

2023-09-26 12:25:49 +03:00

class-form.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

class-gdpr.php

- partially reviewed #1361;

2023-11-30 10:55:00 +02:00

class-login.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-logout.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-mail.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-member-directory-meta.php

Fix cover image size handling and add fallback for invalid sizes

2025-09-06 14:42:15 +03:00

class-member-directory.php

Fix cover image size handling and add fallback for invalid sizes

2025-09-06 14:42:15 +03:00

class-multisite.php

- fixed scroll via enqueue new scroll library;

2019-05-02 18:29:00 +03:00

class-options.php

- WPCS;

2024-03-07 14:56:55 +02:00

class-password.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-permalinks.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-plugin-updater.php

* updated requests to site URL;

2025-01-31 15:19:28 +02:00

class-profile.php

Add new hooks, refactor workflows, and deprecate unused functions

2025-06-25 16:01:08 +03:00

class-query.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-register.php

- updated hookdocs;

2023-07-18 12:06:17 +03:00

class-rewrite.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00

class-roles-capabilities.php

* fixed um_current_user_can();

2024-11-15 11:16:55 +02:00

class-setup.php

Refactor batch action scheduling for account status updates (#1692)

2025-06-18 15:17:19 +03:00

class-shortcodes.php

Fix security vulnerability CVE-2025-13220 in Ultimate Member.

2025-12-05 17:41:51 +02:00

class-templates.php

- WPCS for defined constants;

2023-09-13 22:56:32 +03:00

class-uploader.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user-posts.php

* fixed CVE-2024-12276;

2025-02-03 16:17:37 +02:00

class-user.php

Refactor email placeholders and deprecate obsolete methods

2025-05-19 14:26:39 +03:00

class-validation.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-actions-access.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-actions-account.php

Prevent shortcode execution in user input sanitization.

2025-06-24 17:16:28 +03:00

um-actions-ajax.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-actions-form.php

Fix email validation logic in Ultimate Member forms

2025-06-25 18:09:48 +03:00

um-actions-global.php

* added honeypot scripts/styles via

2025-01-30 13:00:17 +02:00

um-actions-login.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-misc.php

* added security condition to check that one logged-in user cannot activate another one user via email activation link;

2024-10-11 18:47:40 +03:00

um-actions-profile.php

Add $args and $user_id to 'um_after_profile_header_name'

2025-12-02 10:27:13 +02:00

um-actions-register.php

Merge pull request #1694 from ultimatemember/fix/fetch_user_while_password_reset_link

2025-06-18 13:25:16 +03:00

um-actions-save-profile.php

* fixed #1434;

2024-09-26 17:39:57 +03:00

um-actions-user.php

- added escape functions, security fix for XSS;

2019-08-08 00:36:33 +03:00

um-actions-wpadmin.php

- intermediate results with sanitizing form handlers;

2021-06-29 02:51:54 +03:00

um-filters-account.php

- reviewd #1237;

2023-07-04 12:44:06 +03:00

um-filters-avatars.php

* reviewed #1582;

2024-11-13 17:20:52 +02:00

um-filters-commenting.php

- fixed using esc_attr() in href="" attributes;

2024-03-27 11:06:02 +02:00

um-filters-fields.php

* fixed HTML formatted textarea;

2024-10-10 11:56:55 +03:00

um-filters-files.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-login.php

* fixed sending emails upon registration;

2024-10-10 18:18:56 +03:00

um-filters-misc.php

- fixed user registration;

2018-03-20 13:24:38 +02:00

um-filters-navmenu.php

- fixed conditional menu handlers for MegaMenu themes (#1334);

2024-01-04 00:54:19 +02:00

um-filters-profile.php

* fixed deprecated function

2024-09-27 18:01:58 +03:00

um-filters-user.php

* Admin Users bulk-actions

2024-09-24 13:18:48 +03:00