Executive brief
Ultimate Member is a popular WordPress plugin that manages user profiles, registration, and membership features. The plugin contains a stored cross-site scripting vulnerability in profile fields that allows authenticated users with basic subscriber access to inject malicious scripts that execute for all users viewing their profiles. An attacker could exploit this to steal session cookies, redirect users to phishing pages, or perform unauthorized actions on behalf of site administrators.
Technical details
This is a stored XSS vulnerability (CWE-79) affecting textarea profile fields with HTML support in Ultimate Member plugin versions up to 2.12.1. The root cause is insufficient input sanitization combined with a DOM gadget in the pickadate.js library: the wp_kses allowlist permits the id attribute on div elements but fails to escape quotes within the attribute value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() during profile page load, an attacker can break out of attribute context using onfocus/autofocus syntax to execute arbitrary JavaScript. Exploitation requires authenticated access (subscriber level or higher) but no user interaction beyond accessing an injected profile. The vulnerability impacts all users viewing the affected profile. Patches are expected to be released in versions beyond 2.12.1.
Affected products
- Ultimate Member Ultimate Member up to 2.12.1
Timeline
- 2026-08-25: disclosed