What is the CVSS score of EUVD-2026-41486?

EUVD-2026-41486 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Ultimate Member EUVD-2026-41486

| CVE-2026-8489 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-03 Wordfence

GHSA-whj4-pc5c-c7xq

WordPress XSS Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

PR:L confirmed by subscriber-level requirement; S:C reflects cross-origin script execution in victim browser; UI:N applied per stored XSS convention where payload fires on normal page load without attacker-directed victim interaction.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 05:47 vuln.today

CVE Published

Jul 03, 2026 - 04:30 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'about_me' parameter in all versions up to, and including, 2.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) permits any subscriber-level authenticated attacker to inject persistent malicious JavaScript via the 'about_me' profile field, which then executes in the browser of any user - including site administrators - who views the compromised profile page. The scope-changed CVSS vector (S:C, PR:L) reflects that the low barrier to obtaining a subscriber account combined with cross-origin script execution can escalate to full site compromise if an administrator's session is hijacked. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity once a subscriber account is obtained.

Technical ContextAI

Ultimate Member is a WordPress membership plugin (CPE: cpe:2.3:a:ultimatemember:ultimate_member_-_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin:*:*:*:*:*:*:*:*) providing user profiles, registration workflows, and member directories. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the 'about_me' field is accepted through the plugin's form handling pipeline without adequate sanitization on input and without context-aware escaping on output. Wordfence's source code references pinpoint the vulnerable code paths across five files in both the 2.11.2 and 2.11.4 tagged releases: um-filters-fields.php (L271), class-profile.php (L479), class-fields.php (L4577), class-form.php (L854), and um-actions-form.php (L628), indicating the flaw spans multiple layers of the form ingestion and rendering stack rather than a single isolated function.

RemediationAI

No fixed version is confirmed in the available intelligence data - the Wordfence advisory and Trac references only document vulnerable code at versions 2.11.2 and 2.11.4, with no patched release version cited. Site administrators should immediately check the WordPress plugin repository and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/229a4e61-571c-44c6-9972-4dfc743afffe) for a version beyond 2.11.4 that addresses this flaw and apply it as soon as one is available. As a compensating control pending a patch, disable open user registration if it is not business-critical - this removes the ability for unauthenticated actors to create the subscriber accounts required for exploitation. Alternatively, restrict the 'about_me' profile field to trusted roles only, or audit existing user profiles for injected script content. Enabling a web application firewall rule targeting stored XSS patterns in profile fields can provide additional detection and blocking capability, with the trade-off of potential false positives on legitimate HTML content in profiles.