The Ultimate Member plugin for WordPress contains a stored cross‑site scripting flaw in the 'about_me' custom textarea field. The plugin fails to sanitize or escape the input, enabling an authenticated user with a subscriber role or higher to inject arbitrary JavaScript. When other users view the affected profile page, the script runs in their browsers. This is a classic stored XSS vulnerability (CWE‑79). The description does not specify additional post‑exploitation effects; the injected script simply executes whenever the profile page is loaded.

The vulnerability affects all WordPress sites that install the Ultimate Member plugin with a version up to and including 2.11.4. Any user with a subscriber or higher role who can edit the 'about_me' field is at risk. The plugin is published by The Ultimate Member team as the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low likelihood of mass exploitation with available code. The flaw is not in the CISA KEV catalog. Exploitation requires authentication with a subscriber or higher account; the attacker can inject via the plugin’s front‑end form, and the unsanitized content renders on the profile page, executing the script for all visitors until the plugin is updated or the content is removed.