What is the CVSS score of CVE-2025-15064?

CVE-2025-15064 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin CVE-2025-15064

EUVD-2025-209217 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

GHSA-px95-m842-v7xq

WordPress XSS Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin Ultimatemember

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 07:45 euvd

EUVD-2025-209217

Analysis Generated

Apr 04, 2026 - 07:45 vuln.today

CVE Published

Apr 04, 2026 - 07:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when "HTML support for user description" is enabled in Ultimate Member settings.

AnalysisAI

Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above to inject arbitrary JavaScript via the user description field when HTML support is enabled, executing malicious scripts in pages viewed by other users. The vulnerability requires prior authentication and user interaction but affects site visitors broadly once injected. Wordfence reported the issue; a fix is available in patched versions.

Technical ContextAI

Ultimate Member is a WordPress plugin that provides user profile, registration, and member directory functionality. The vulnerability stems from insufficient input sanitization and output escaping in the user description field (CWE-79: Improper Neutralization of Input During Web Page Generation). When the plugin's 'HTML support for user description' setting is enabled, user-supplied HTML and JavaScript are stored in the database without proper sanitization and later rendered without adequate escaping. This allows authenticated users with subscriber-level access or higher to inject persistent malicious scripts that execute in the browser context of any visitor viewing the compromised user profile or related pages.

RemediationAI

Upgrade Ultimate Member plugin to version 2.11.2 or later, which addresses the input sanitization and output escaping deficiencies. Administrators should immediately update via the WordPress plugin directory or GitHub repository (https://github.com/ultimatemember/ultimatemember). As an interim mitigation pending upgrade, disable the 'HTML support for user description' setting in Ultimate Member plugin configuration to prevent script injection and execution, though this reduces profile functionality. Additionally, audit existing user profiles for suspicious content injected before patching, and consider limiting subscriber-level user registration if the feature is not essential.