Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin CVE-2025-15064

The CVSS 6.4 score reflects a network-accessible vulnerability with low attack complexity and low privilege requirements (PR:L). The attack requires authenticated access (subscriber level minimum) and does not require user interaction beyond the attacker's own profile modifications, though it does require victims to view the injected content. EPSS exploitation probability is moderate given the requirement for authentication and the conditional feature flag (HTML support must be enabled). SSVC considerations favor this as a practical priority: exploitation is straightforward (inject HTML/JS into profile), automatable (simple form submission), and causes integrity impact through script execution. KEV status and active exploitation data are not provided, suggesting this has not been confirmed as actively exploited in the wild at time of analysis. However, the authenticated-but-low-privilege barrier and feature-flag requirement lower real-world risk compared to unauthenticated XSS vectors. Organizations with many user accounts or public-facing member directories should prioritize this.

An authenticated attacker with subscriber-level access registers or logs into a WordPress site running Ultimate Member with HTML support enabled. The attacker crafts a user description containing a <script> tag or event handler (e.g., <img src=x onerror='alert(1)'>) and saves their profile. When site administrators, members, or public visitors view the attacker's profile page or member directory listing, the malicious script executes in their browsers, potentially stealing session cookies, redirecting to phishing pages, or modifying page content. No special user interaction is required beyond the victim viewing the profile-the XSS payload triggers automatically.