EUVD-2026-65460
GHSA-rhh6-vxq9-rqm4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Subscriber-level account required (PR:L); autofocus-triggered DOM gadget fires on page load with no victim interaction (UI:N); script executes in visitor's browser context confirming scope change (S:C).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
AnalysisAI
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account with subscriber-level privileges or higher - unauthenticated external attackers cannot exploit this vulnerability directly; they must first obtain or create an account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N presents a nuanced risk picture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ultimate Member plugin to a version incorporating the fix referenced in the upstream changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3663931%40ultimate-member&new=3663931%40ultimate-member - note that a specific patched release version number is not independently confirmed from the available data (upstream fix available via commit; released patch version not confirmed; verify the WordPress plugin repository for the current release). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin
View allAccount takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated user
A information disclosure vulnerability in for WordPress is vulnerable to Sensitive Information Exposure in all (CVSS 8.0
Stored Cross-Site Scripting in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) permits any subscriber-level aut
Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today