Ultimate Member EUVD-2026-111558

The attacker must hold an authenticated account at subscriber level or above (PR:L) and be able to set the 'user_url' / Website URL field on their public Ultimate Member profile with a malicious payload. Execution requires a victim to click that Website URL link on the attacker's public profile; per the description this condition is trivially met because the redirect-confirmation onclick handler is enabled by default on all new installations. Limiting factors: exploitation needs valid (subscriber+) authentication, requires the victim to view and click the link on the attacker's profile rather than firing automatically, and only affects versions up to and including 2.14.0 - sites on 2.14.1 or later are fixed.

This is a medium-severity stored XSS (CVSS 6.4) that should be treated as a routine-but-real patching priority rather than an emergency, consistent with the vuln.today 'this_month' decision label. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity flaw requiring only low privileges, with a scope change reflecting that injected script executes in other users' browser context. Authentication is required: PR:L confirms an authenticated attacker at subscriber level or above, as the description also states. A key conflict exists in the signals: the provided CVSS vector sets UI:N (no user interaction), yet the description explicitly states that successful exploitation requires a visitor to click the attacker's Website URL link - this is user interaction and argues for UI:R; the description tempers this by noting the redirect-confirmation onclick handler is enabled by default, making the click condition easy to satisfy but not eliminating it. No EPSS score, KEV listing, or confirmed public exploit is present in the input, so there is no evidence of active or probable near-term mass exploitation. The combination of a low-privilege self-registration barrier (WordPress subscriber accounts are often open) plus a popular plugin keeps this relevant, but the medium impact (C:L/I:L, A:N) and absence of exploitation signals place it below critical-triage items.

An attacker registers a subscriber-level account on a site running Ultimate Member and injects a malicious script payload into the 'user_url' (Website URL) field of their public profile, which is insufficiently sanitized and escaped. When another user - potentially an administrator - views the attacker's profile and clicks the Website URL link, the stored script executes in their browser session. No public exploit is identified at time of analysis, though the vulnerable code paths are referenced in the WordPress plugin trac.