EUVD-2026-41819
GHSA-qhrq-pqx6-6f9v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network stored XSS needing a Subscriber account (PR:L) and victim viewing (UI:R); scope changes to the victim's browser (S:C) with high confidentiality/integrity impact on the admin session but no availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level users inject persistent JavaScript through custom textarea profile fields, which executes in the browser of any visitor - including administrators - who views the poisoned profile. Publicly available exploit code exists (WPScan), though EPSS is low (0.17%) and SSVC records no observed exploitation, so this is a real but not yet actively-exploited privilege-escalation-capable XSS.
Technical ContextAI
Ultimate Member is a popular WordPress membership and user-profile plugin that renders user-supplied profile fields on front-end profile pages. The flaw is a classic stored/persistent Cross-Site Scripting issue (CWE-79, though the CWE was not populated in the source data): the value of custom textarea profile fields is neither sanitised nor output-escaped before being written into the profile page HTML, so script payloads persist server-side and run in the DOM context of the WordPress site whenever the profile is viewed. Because output escaping is missing, any registered user who can edit their own profile becomes a script-injection vector against higher-privileged viewers. The CPE cpe:2.3:a:unknown:ultimate_member:*:*:*:*:*:*:*:* identifies the affected application generically without a version boundary, so the authoritative version data comes from the advisory (all versions prior to 2.12.0).
RemediationAI
Vendor-released patch: upgrade the Ultimate Member plugin to version 2.12.0 or later, which adds proper sanitisation and output-escaping of custom textarea profile field values; this is the primary and complete fix. Consult the WPScan advisory at https://wpscan.com/vulnerability/96adb2d3-af34-4455-97d4-90af58049e78/ for confirmation. If immediate patching is not possible, apply compensating controls: disable or remove custom textarea-type profile fields via the Ultimate Member form builder to eliminate the injection sink (trade-off: loss of that profile functionality for all users); restrict new user registration or require manual approval so untrusted accounts cannot self-provision the required Subscriber access (trade-off: added onboarding friction); and consider a WAF rule to strip script/HTML tags from profile field submissions (trade-off: may break legitimate rich-text input and can be bypassed). Avoid viewing untrusted user profiles from an authenticated administrator session until patched.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows una
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registra
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o
Cross-site scripting (XSS) vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remo
Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today