Quick answers
- Is CVE-2025-15064 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-15064 being exploited in the wild.
- How severe is CVE-2025-15064?
- Medium severity, with a CVSS score of 6.4, published 4 April 2026.
- Which products and versions are affected?
- Ultimate Member <= 2.11.1.
- Is there a fix for CVE-2025-15064?
- A patch was published on 2026-02-04: Patch merged into development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-15064 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-15064?
- Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ultimate Member WordPress plugin due to insufficient input sanitization and output escaping of the user description field. Authenticated attackers with subscriber-level permissions or higher can inject arbitrary web scripts into their profile. These scripts execute in the context of any user viewing the profile page. The vulnerability is specifically exploitable when the 'HTML support for user description' setting is active. The issue was addressed in version 2.11.2 by deprecating HTML usage in user descriptions and refactoring form sanitization to use 'user_description' kses filters.
Affected products
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.1
Timeline
- 2025-12-30: other: Fix developed and version 2.11.2 prepared
- 2026-02-04: patched: Patch merged into development branch
- 2026-04-04: disclosed: Public advisory published