The vulnerability resides in the user description field of the Ultimate Member plugin for WordPress. Insufficient input sanitization and output escaping allow an authenticated attacker with subscriber‑level or higher access to embed arbitrary JavaScript into a user profile. When other users view that profile, the script runs in their browsers, potentially allowing cookie theft, defacement, or redirection. This flaw is a classic stored cross‑site scripting (CWE‑79) issue.

WordPress sites using Ultimate Member plugin version 2.11.1 or earlier, with the HTML support for user description setting enabled. Any user account with subscriber or higher role can exploit the vulnerability.

The CVSS base score of 6.4 reflects moderate severity. No EPSS score is available and the flaw is not in CISA KEV. Exploitation requires valid credentials and subscriber‑level access; the attacker must edit a profile description field with malicious code, and the script executes upon subsequent profile visits. The attack vector is authentication‑based; mitigation hinges on disabling the feature or applying the patch.