Ultimate Member User Profile Registration Login Member Directory Content Restriction Membership Plugin
Monthly
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Account takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated users to harvest live password reset links for any account, including administrators, by chaining three logic bugs in the member directory subsystem. The flaw enables full site compromise because reset URLs can be used to set new administrator passwords. No public exploit identified at time of analysis, though Wordfence has published detailed technical write-ups that significantly lower the bar for weaponization.
A information disclosure vulnerability in for WordPress is vulnerable to Sensitive Information Exposure in all (CVSS 8.0). High severity vulnerability requiring prompt remediation.
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.
Stored Cross-Site Scripting in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) permits any subscriber-level authenticated attacker to inject persistent malicious JavaScript via the 'about_me' profile field, which then executes in the browser of any user - including site administrators - who views the compromised profile page. The scope-changed CVSS vector (S:C, PR:L) reflects that the low barrier to obtaining a subscriber account combined with cross-origin script execution can escalate to full site compromise if an administrator's session is hijacked. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity once a subscriber account is obtained.
Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above to inject arbitrary JavaScript via the user description field when HTML support is enabled, executing malicious scripts in pages viewed by other users. The vulnerability requires prior authentication and user interaction but affects site visitors broadly once injected. Wordfence reported the issue; a fix is available in patched versions.
Unauthenticated attackers can read privacy-restricted member profile field data in the WordPress plugin Ultimate Member (all versions up to and including 2.13.1) by calling the publicly reachable AJAX endpoint wp_ajax_nopriv_um_get_members, which fails to verify that the requester is authorized to see fields marked owner-only, members-only, or role-restricted. The endpoint's supposed protection, the 'um-frontend-nonce' token, is published to every anonymous visitor through wp_localize_script, so it provides no real access control and any anonymous visitor can satisfy the endpoint's checks; this yields a high-confidentiality, no-integrity/no-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the attack surface is default-configuration and remote, so the only practical prerequisite is that the site actually has privacy-restricted profile fields containing sensitive values. The vendor addressed the issue in Ultimate Member 2.14.0, whose release notes explicitly credit Wordfence for reporting CVE-2026-93428.
Stored cross-site scripting in the Ultimate Member WordPress plugin (User Profile, Registration, Login, Member Directory, Content Restriction & Membership) through version 2.13.1 lets unauthenticated attackers inject arbitrary JavaScript into the 'form_id' parameter of a form submission; the payload is persisted unescaped into the registering user's 'submitted' usermeta via update_user_meta() and only executes when an administrator opens that specific user record in the wp-admin Users modal, where the stored value is inserted through jQuery .html(). The CVSS vector (AV:N/AC:L/PR:N, scope-changed) reflects that the script runs in the privileged admin context, but practical exploitation depends on anonymous users being able to reach a UM registration/profile form and on an administrator subsequently viewing the poisoned user record, so it is a conditionally-triggered issue rather than a drive-by compromise. No public exploit code was identified at time of analysis and the issue is not reported as actively exploited; the vendor addressed it in Ultimate Member 2.14.0.
Account takeover in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) allows Contributor-level authenticated users to harvest live password reset links for any account, including administrators, by chaining three logic bugs in the member directory subsystem. The flaw enables full site compromise because reset URLs can be used to set new administrator passwords. No public exploit identified at time of analysis, though Wordfence has published detailed technical write-ups that significantly lower the bar for weaponization.
A information disclosure vulnerability in for WordPress is vulnerable to Sensitive Information Exposure in all (CVSS 8.0). High severity vulnerability requiring prompt remediation.
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.
Stored Cross-Site Scripting in the Ultimate Member WordPress plugin (versions ≤ 2.11.4) permits any subscriber-level authenticated attacker to inject persistent malicious JavaScript via the 'about_me' profile field, which then executes in the browser of any user - including site administrators - who views the compromised profile page. The scope-changed CVSS vector (S:C, PR:L) reflects that the low barrier to obtaining a subscriber account combined with cross-origin script execution can escalate to full site compromise if an administrator's session is hijacked. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack is low-complexity once a subscriber account is obtained.
Stored cross-site scripting in Ultimate Member plugin versions up to 2.11.1 allows authenticated subscribers and above to inject arbitrary JavaScript via the user description field when HTML support is enabled, executing malicious scripts in pages viewed by other users. The vulnerability requires prior authentication and user interaction but affects site visitors broadly once injected. Wordfence reported the issue; a fix is available in patched versions.