Description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
Published: 2026-08-25
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a stored XSS flaw caused by insufficient sanitization and output escaping in a textarea profile field that accepts HTML. It allows an authenticated user with subscriber‑level or higher access to inject JavaScript that will run when any user views the profile page, potentially enabling session hijacking, defacement, or data exfiltration.

Affected Systems

WordPress sites that have installed the Ultimate Member plugin version 2.12.1 or earlier are impacted. The flaw exists in all releases up to and including 2.12.1 of the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, and the vulnerability is exploitable over the web by any authenticated user with subscriber-level privileges. Although EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, the attack vector is likely straightforward via the user profile editing interface, making it a practical risk for affected sites. Proper authentication is required, but once logged in, an attacker can inject scripts that execute in the context of other users visiting the profile page.

Generated by OpenCVE AI on August 25, 2026 at 12:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Ultimate Member plugin to the latest version (2.12.2 or newer) where the input sanitization bug is fixed.
  • If an upgrade is not immediately possible, disable the HTML support feature for the textarea profile field in the plugin settings to prevent script content from being stored.
  • Additionally, implement or enable stricter output escaping on the profile page to ensure that any remaining user‑supplied HTML is rendered harmless.

Generated by OpenCVE AI on August 25, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Ultimatemember
Ultimatemember ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Wordpress
Wordpress wordpress
Vendors & Products Ultimatemember
Ultimatemember ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Wordpress
Wordpress wordpress

Tue, 25 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
Title Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-25T11:27:12.131Z

Reserved: 2026-07-31T21:25:26.927Z

Link: CVE-2026-18547

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T12:16:23.490

Modified: 2026-08-25T12:16:23.490

Link: CVE-2026-18547

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T12:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')