The Ultimate Member plugin for WordPress is vulnerable to stored cross‑site scripting when an authenticated user with Contributor role or higher inserts arbitrary script code inside shortcode attributes. The plugin fails to sanitize and escape these inputs, so the malicious payload is persisted and later delivered to any user who opens a page that contains the shortcode. This weakness, identified as CWE‑79, can compromise user confidentiality and integrity by enabling session hijacking, defacement, or malicious redirection.

WordPress sites that have the Ultimate Member plugin, developed by Ultimate Member, installed in any version up to and including 2.11.0 are affected. All installations of these plugin versions are potentially vulnerable, while later releases (2.12 and newer) address the flaw. The issue is confined to this plugin and does not impact WordPress core or other plugins.

The CVSS base score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently considered unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires an authenticated user with at least Contributor privileges, the attack surface is limited to users who can edit content or shortcodes, and no public exploit code is currently documented. Overall risk remains moderate, but the impact on users who view injected pages can be significant.