Ultimate Member CVE-2026-11766

Exploitation requires: (1) an authenticated account of Subscriber level or above - the site must permit user registration or the attacker must otherwise obtain a low-privilege account (PR:L); (2) the Ultimate Member plugin configured with at least one custom textarea profile field that the attacker can populate - this is the exact injection sink named in the description; and (3) user interaction, namely a higher-privileged user or administrator subsequently viewing the malicious profile (UI:R) for payload execution and impact. Limiting factors: this is NOT unauthenticated and NOT automatable (SSVC Automatable: no) because it depends on a victim voluntarily viewing the crafted profile; sites that disable open registration, do not use custom textarea profile fields, or whose admins never view arbitrary user profiles are substantially less exposed.

The CVSS 3.1 base score is 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H): network-reachable, low complexity, but requiring low-level authentication (a Subscriber account) and victim interaction (an admin/user must view the malicious profile). Signals diverge on urgency: a public exploit exists per WPScan and SSVC rates Technical Impact as 'total,' yet SSVC also records Exploitation as 'none' and Automatable as 'no,' and EPSS is only 0.17% (6th percentile), indicating low probability of widespread automated exploitation in the near term. There is no CISA KEV listing. The C:H/I:H/A:H impact rating reflects worst-case account takeover of an administrator via session/credential theft rather than direct system compromise, which is the standard (and arguably generous) scoring convention for admin-targeting stored XSS. Net: this is a legitimate priority for any site with untrusted user registration open, but the 'not automatable, low EPSS, no active exploitation' profile places it below internet-facing unauthenticated RCE bugs - patch promptly rather than emergency.

An attacker registers an ordinary Subscriber account on a WordPress site running a vulnerable Ultimate Member version, edits their profile, and stores a JavaScript payload (e.g. a cookie/session exfiltration or admin-action CSRF script) inside a custom textarea profile field. When an administrator later browses that user's profile, the script executes in the admin's authenticated browser context, enabling session hijacking or actions on the admin's behalf. Public exploit code for this vector is available via WPScan, and the low attack complexity makes reproduction straightforward once registration access is obtained.