EUVD-2026-83504
GHSA-w2mq-x7qr-mgcw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
PR:N because self-registration is the plugin's core function; UI:R since a victim must view the profile; C/I/A:H as admin-session script execution enables full site takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
AnalysisAI
Stored cross-site scripting in the Ultimate Member plugin for WordPress (all versions before 2.13.1) lets unauthenticated attackers - per the supplied CVSS vector, PR:N - register an account, set a crafted profile name, and plant JavaScript that executes in the browser of any visitor who opens that profile, including a logged-in administrator (UI:R). The root cause is a two-part failure: the plugin does not escape the profile-name-derived value before writing it into the page title, and it decodes HTML entities after its own sanitisation has already run, so the payload survives filtering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that new-user registration be enabled on the site (the default and intended mode for the Ultimate Member membership plugin), allowing an attacker to create an account and set a profile name. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority, not a high-CVSS-but-low-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Ultimate Member to 2.13.1 or later, per the WPScan advisory at https://wpscan.com/vulnerability/a49b734f-2244-4d6f-8912-b4ce6ba9eb0f/ (also referenced via NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-85680), and then audit existing user profiles for stored payloads planted before the upgrade, since patching closes the injection path but does not automatically clean already-persisted malicious profile names. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress deployment using Ultimate Member and upgrade all instances to version 2.13.1 (or the latest available release); where patching cannot occur immediately, disable the plugin or restrict public profile viewing until remediation is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ultimate Member
View allThe Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary c
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. Rated high severity (
A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress a
Privilege escalation to administrator in the Ultimate Member WordPress plugin (versions 2.6.7 through 2.12.x) allows una
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registra
Stored cross-site scripting in the Ultimate Member WordPress plugin before 2.12.0 lets authenticated Subscriber-level us
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today