Is CVE-2026-116621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116621 being exploited in the wild.

How severe is CVE-2026-116621?

Medium severity, with a CVSS score of 6.4, published 7 November 2026.

Which products and versions are affected?

Ultimate Member up to and including 2.14.1.

Is there a fix for CVE-2026-116621?

Yes: fixed in 2.14.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116621 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-116621?

Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116621: Ultimate Member plugin stored cross-site scripting in textarea field

CVE-2026-116621 · Severity: medium · CVSS 6.4 · Published 2026-11-07

The Ultimate Member plugin for WordPress allows authenticated users to inject malicious scripts into custom textarea fields on user profiles due to insufficient sanitization. An attacker with subscriber privileges or above can embed hidden scripts that execute when other users visit the compromised profile page, potentially leading to account compromise, credential theft, or malware distribution.

Technologies: Ultimate Member. Vendors: Ultimate Member.

Quick answers

Is CVE-2026-116621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116621 being exploited in the wild.
How severe is CVE-2026-116621?: Medium severity, with a CVSS score of 6.4, published 7 November 2026.
Which products and versions are affected?: Ultimate Member up to and including 2.14.1.
Is there a fix for CVE-2026-116621?: Yes: fixed in 2.14.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116621 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-116621?: Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.14.2

Technical details

Stored cross-site scripting (XSS) vulnerability in the 'pm_note' parameter and any custom textarea metakey field where HTML is disabled. The vulnerability exists due to improper input sanitization and output escaping, allowing authenticated attackers to inject arbitrary JavaScript. Exploitation requires a victim to click an attacker-crafted link that triggers a DOM gadget concatenating unescaped data-src values into an HTML string passed to jQuery.

Affected products

Ultimate Member Ultimate Member up to and including 2.14.1

Timeline

2026-11-07: disclosed
2026-11-02: patched: Released in version 2.14.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.