What’s Vulnerable › Products

Ultimate Multisite vulnerabilities

2 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your Ultimate Multisite version is affected

Latest Ultimate Multisite vulnerabilities

• CVE-2026-107508 — Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter (CVSS 8.6)
• CVE-2026-103646 — Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter (CVSS 9.8)