EUVD-2025-209217
GHSA-px95-m842-v7xq
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when "HTML support for user description" is enabled in Ultimate Member settings.
Analysis
Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above to inject arbitrary JavaScript via the user description field when HTML support is enabled, executing malicious scripts in pages viewed by other users. The vulnerability requires prior authentication and user interaction but affects site visitors broadly once injected. Wordfence reported the issue; a fix is available in patched versions.
Technical Context
Ultimate Member is a WordPress plugin that provides user profile, registration, and member directory functionality. The vulnerability stems from insufficient input sanitization and output escaping in the user description field (CWE-79: Improper Neutralization of Input During Web Page Generation). When the plugin's 'HTML support for user description' setting is enabled, user-supplied HTML and JavaScript are stored in the database without proper sanitization and later rendered without adequate escaping. This allows authenticated users with subscriber-level access or higher to inject persistent malicious scripts that execute in the browser context of any visitor viewing the compromised user profile or related pages.
Affected Products
Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (CPE: cpe:2.3:a:ultimatemember:ultimate_member_-_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin:*:*:*:*:*:*:*:*) is affected in all versions up to and including 2.11.1. The vulnerability is conditional on the 'HTML support for user description' setting being enabled in plugin configuration.
Remediation
Upgrade Ultimate Member plugin to version 2.11.2 or later, which addresses the input sanitization and output escaping deficiencies. Administrators should immediately update via the WordPress plugin directory or GitHub repository (https://github.com/ultimatemember/ultimatemember). As an interim mitigation pending upgrade, disable the 'HTML support for user description' setting in Ultimate Member plugin configuration to prevent script injection and execution, though this reduces profile functionality. Additionally, audit existing user profiles for suspicious content injected before patching, and consider limiting subscriber-level user registration if the feature is not essential.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today