CVE-2026-85680

Overview

The Ultimate Member WordPress plugin (v<2.13.1) fails to properly escape user‑supplied profile names, allowing unauthenticated attackers to inject JavaScript that runs when any visitor, including admins, view the profile. This flaw enables cross‑site scripting (XSS) without requiring authentication. It matters because any site using the vulnerable plugin can be compromised by a simple account registration.

Description

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

Impact

Confidentiality: attackers can steal session cookies or other sensitive data from users who view the malicious profile. Integrity: injected scripts can modify page content or perform actions on behalf of the victim. Availability: repeated exploitation may degrade user experience. The primary impact is on site visitors and administrators who view the compromised profile.

Remediation

1. Update Ultimate Member to version 2.13.1 or later. 2. If an update is not immediately possible, disable the profile name field or enforce strict sanitization (e.g., strip all tags). 3. Implement a Content Security Policy that blocks inline scripts and restricts script sources to trusted domains. 4. Monitor user registrations for suspicious activity and review logs for unexpected script execution.

Risk context

Severity is high (CVSS 8.8) but the EPSS score of 0.00172 indicates a low likelihood of exploitation in the near term. Defenders should treat this as a moderate‑to‑high priority vulnerability, especially for sites with high traffic or sensitive user data.

Affected products

• WordPress Ultimate Member <2.13.1