The Ultimate Member WordPress plugin, prior to version 2.13.1, fails to properly escape the profile title value supplied by users. The title is sanitised but later processed through an HTML entity decoder, allowing an attacker to embed malicious JavaScript that is stored and executed on page load. This results in a permanent cross‑site scripting flaw that can compromise the integrity of visitor sessions and expose sensitive data.

Any WordPress site running the Ultimate Member plugin with a version older than 2.13.1 is impacted. The flaw is independent of the site’s user roles, meaning unauthenticated users who register can trigger the vulnerability, affecting regular visitors and administrators alike.

Based on the description, an attacker can exploit this flaw by registering a new account and setting a crafted profile title containing JavaScript. This script is stored and will execute for any visitor who views the profile page, including administrators. It is inferred that creating a malicious account may only require basic scripting knowledge, but the description does not specify skill level. No CVSS or EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog.