Executive brief
Ultimate Member, a popular WordPress plugin used for user profiles and community management, contains a security flaw in how it handles user-provided text. An attacker with a basic user account can save malicious scripts into their profile fields. If an administrator or another user views that profile, the script will execute in their browser, potentially allowing the attacker to hijack administrative sessions or perform unauthorized actions on the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ultimate Member plugin for WordPress in versions prior to 2.12.0. The root cause is a failure to properly sanitize and escape user input within custom textarea profile fields before it is rendered on the profile page. An authenticated attacker with at least Subscriber-level privileges can inject malicious JavaScript into these fields. When a victim, such as a site administrator, views the compromised profile, the script executes within the context of the victim's session. This can lead to session hijacking, unauthorized configuration changes, or further exploitation of the WordPress environment. The issue is resolved in version 2.12.0.
Affected products
- Ultimate Member Ultimate Member before 2.12.0
Timeline
- 2026-06-15: disclosed: Publicly published by WPScan
- 2026-07-06: advisory: NVD publication date
- 2026-06-15: patched: Fixed in version 2.12.0