WP-Safety

BuddyForms Ultimate Member Security & Risk Analysis

wordpress.org/plugins/buddyforms-ultimate-member

Submit and Manage Posts from your Ultimate Member Profile. Create Forms with an easy to use Form Builder! Create Tabs - Group Forms.

100 active installs v1.3.18 PHP + WP 3.9+ Updated Nov 20, 2023
buddyformscustom-formformformsultimate-member
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Plugin page Download
Safety Verdict

Is BuddyForms Ultimate Member Safe to Use in 2026?

Generally Safe

Score 85/100

BuddyForms Ultimate Member has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 2yr ago
Risk Assessment

The "buddyforms-ultimate-member" plugin v1.3.18 exhibits a generally strong security posture based on the provided static analysis. The complete absence of AJAX handlers, REST API routes, shortcodes, and cron events with unprotected entry points indicates a well-defined and secured attack surface. The code also demonstrates good practices with 100% of SQL queries using prepared statements, a high percentage of properly escaped output (89%), and the presence of both nonce and capability checks. The taint analysis shows a limited number of flows, with no critical or high severity issues, further reinforcing a low-risk profile.

Key Concerns

  • Flow with unsanitized paths
  • Unescaped output detected
Vulnerabilities
None known

BuddyForms Ultimate Member Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

BuddyForms Ultimate Member Release Timeline

v1.3.18Current
v1.3.17
v1.3.16
v1.3.15
v1.3.14
v1.3.13
v1.3.12
v1.3.11
v1.3.10
v1.3.9
v1.3.8
v1.3.7
v1.3.6
v1.3.5
v1.3.4
v1.3.2
v1.3
v1.2.3
v1.2.2
v1.2.1
Code Analysis
Analyzed Mar 16, 2026

BuddyForms Ultimate Member Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
13
101 escaped
Nonce Checks
5
Capability Checks
13
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

89% escaped114 total outputs
Data Flows · Security
1 unsanitized

Data Flow Analysis

2 flows1 with unsanitized paths
bf_profile_tabs_content (includes\ultimate-member-extension.php:104)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

BuddyForms Ultimate Member Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 53
filterpostbox_classes_buddyforms_buddyforms_ultimate_membersincludes\form-builder.php:9
filterpostbox_classes_buddyforms_buddyforms_ultimate_membersincludes\form-builder.php:10
filterpostbox_classes_buddyforms_buddyforms_ultimate_membersincludes\form-builder.php:11
filteradd_meta_boxesincludes\form-builder.php:134
filterbuddyforms_front_js_css_loaderincludes\functions.php:14
actionbuddyforms_process_submission_endincludes\functions.php:51
filterbuddyforms_ask_to_become_an_author_urlincludes\functions.php:118
filterbuddyforms_create_submission_linkincludes\functions.php:148
filterbuddyforms_next_posts_linkincludes\functions.php:151
filterbuddyforms_previos_posts_linkincludes\functions.php:171
filterinitincludes\profile-tab-cpublishing.php:6
filterum_profile_tabsincludes\profile-tab-cpublishing.php:15
actionum_profile_content_buddyforms_cpublishing_defaultincludes\profile-tab-cpublishing.php:78
filterinitincludes\profile-tab-moderators.php:6
filterum_profile_tabsincludes\profile-tab-moderators.php:14
actionum_profile_content_buddyforms_moderation_defaultincludes\profile-tab-moderators.php:78
actiontemplate_redirectincludes\redirect.php:27
filterpage_linkincludes\redirect.php:126
filterbuddyforms_loop_edit_post_linkincludes\redirect.php:157
actioninitincludes\resources\tgm\class-tgm-plugin-activation.php:5
filterload_textdomain_mofileincludes\resources\tgm\class-tgm-plugin-activation.php:5
actioninitincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_menuincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_headincludes\resources\tgm\class-tgm-plugin-activation.php:5
filterinstall_plugin_complete_actionsincludes\resources\tgm\class-tgm-plugin-activation.php:5
filterupdate_plugin_complete_actionsincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_noticesincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_initincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_enqueue_scriptsincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionload-plugins.phpincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionswitch_themeincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionswitch_themeincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionadmin_initincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionswitch_themeincludes\resources\tgm\class-tgm-plugin-activation.php:5
actionload_textdomain_mofileincludes\resources\tgm\class-tgm-plugin-activation.php:5
filterupgrader_source_selectionincludes\resources\tgm\class-tgm-plugin-activation.php:22
actionplugins_loadedincludes\resources\tgm\class-tgm-plugin-activation.php:22
filtertgmpa_table_data_itemsincludes\resources\tgm\class-tgm-plugin-activation.php:22
filterupgrader_source_selectionincludes\resources\tgm\class-tgm-plugin-activation.php:29
actionadmin_initincludes\resources\tgm\class-tgm-plugin-activation.php:29
actionupgrader_process_completeincludes\resources\tgm\class-tgm-plugin-activation.php:29
filterupgrader_post_installincludes\resources\tgm\class-tgm-plugin-activation.php:29
filterupgrader_post_installincludes\resources\tgm\class-tgm-plugin-activation.php:29
filterum_profile_tabsincludes\ultimate-member-extension.php:7
filterum_user_profile_tabsincludes\ultimate-member-extension.php:8
filterum_user_profile_subnav_linkincludes\ultimate-member-extension.php:185
filterbuddyforms_admin_tabsincludes\ultimate-member-settings.php:16
actionbuddyforms_settings_page_tabincludes\ultimate-member-settings.php:148
actionadmin_initincludes\ultimate-member-settings.php:155
actioninitloader.php:36
actioninitloader.php:99
actiontgmpa_registerloader.php:109
actionbuddyforms_core_fs_loadedloader.php:226
Maintenance & Trust

BuddyForms Ultimate Member Maintenance & Trust

Maintenance Signals

WordPress version tested6.4.8
Last updatedNov 20, 2023
PHP min version
Downloads28K

Community Trust

Rating80/100
Number of ratings4
Active installs100
Alternatives

BuddyForms Ultimate Member Alternatives

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

wpforms-lite

A
88

The best WordPress contact form plugin. Drag & Drop form builder to create beautiful contact forms, payment forms, & other custom forms.

6.0M 16 CVEs
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

fluentform

B
82

Get a fast contact form plugin. Create advanced forms using drag and drop form builder with all smart features.

700K 33 CVEs
Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

forminator

B
76

Best WordPress form builder plugin. Create contact forms, payment forms & order forms with 1000+ integrations.

600K 41 CVEs
SureForms – Contact Form, Payment Form & Other Custom Form Builder

SureForms – Contact Form, Payment Form & Other Custom Form Builder

sureforms

A
88

The most beginner-friendly AI Form Builder for WordPress. Create contact, payment, quiz & custom forms with advanced features in minutes.

500K 16 CVEs
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

formidable

B
76

The most advanced WordPress forms plugin. Go beyond contact forms with our drag and drop form builder for surveys, quizzes, and more.

300K 23 CVEs
Developer Profile

BuddyForms Ultimate Member Developer Profile

Themekraft

12 plugins · 5K total installs

69
trust score
Avg Security Score
86/100
Avg Patch Time
375 days
View full developer profile
Detection Fingerprints

How We Detect BuddyForms Ultimate Member

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/buddyforms-ultimate-member/assets/
Script Paths
/wp-content/plugins/buddyforms-ultimate-member/assets/js/buddyforms-ultimate-member.js/wp-content/plugins/buddyforms-ultimate-member/assets/css/buddyforms-ultimate-member.css
Version Parameters
buddyforms-ultimate-member/assets/js/buddyforms-ultimate-member.js?ver=buddyforms-ultimate-member/assets/css/buddyforms-ultimate-member.css?ver=

HTML / DOM Fingerprints

CSS Classes
buddyforms_ultimate_member_pagebf-um-tab-wrapperbf-um-tab-contentbf-um-tab-nav
HTML Comments
Check the plugin dependencies
Data Attributes
data-bf-um-tab
JS Globals
buddyforms_ultimate_member
FAQ

Frequently Asked Questions about BuddyForms Ultimate Member