# CVE-2026-18547: Ultimate Member stored XSS in textarea profile field via DOM gadget

Source: https://junglewise.ai/threats/cve-2026-18547-ultimate-member-stored-xss-in-textarea-profile-field-via-dom  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18547 · Severity: medium · CVSS 6.4 · Published 2026-08-25

Ultimate Member is a popular WordPress plugin that manages user profiles, registration, and membership features. The plugin contains a stored cross-site scripting vulnerability in profile fields that allows authenticated users with basic subscriber access to inject malicious scripts that execute for all users viewing their profiles. An attacker could exploit this to steal session cookies, redirect users to phishing pages, or perform unauthorized actions on behalf of site administrators.

Technologies: [Ultimate Member](https://junglewise.ai/threats/technologies/ultimate-member). Vendors: [Ultimate Member](https://junglewise.ai/threats/vendors/ultimate-member).

## Quick answers

**Is CVE-2026-18547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18547 being exploited in the wild.

**How severe is CVE-2026-18547?** Medium severity, with a CVSS score of 6.4, published 25 August 2026.

**Which products and versions are affected?** Ultimate Member up to 2.12.1.

**Is there a fix for CVE-2026-18547?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18547 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18547?** Check whether you run Ultimate Member at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored XSS vulnerability (CWE-79) affecting textarea profile fields with HTML support in Ultimate Member plugin versions up to 2.12.1. The root cause is insufficient input sanitization combined with a DOM gadget in the pickadate.js library: the wp_kses allowlist permits the id attribute on div elements but fails to escape quotes within the attribute value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() during profile page load, an attacker can break out of attribute context using onfocus/autofocus syntax to execute arbitrary JavaScript. Exploitation requires authenticated access (subscriber level or higher) but no user interaction beyond accessing an injected profile. The vulnerability impacts all users viewing the affected profile. Patches are expected to be released in versions beyond 2.12.1.

## Affected products

- Ultimate Member Ultimate Member up to 2.12.1

## Timeline

- 2026-08-25: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/assets/js/common.js](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/assets/js/common.js)
- [https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/class-functions.php](https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.11.4/includes/class-functions.php)

## Related threats

- [Ultimate Member plugin stored cross-site scripting in textarea field](https://junglewise.ai/threats/cve-2026-116621-the-ultimate-member-user-profile-registration-login-member)
- [Ultimate Member plugin PHP object injection](https://junglewise.ai/threats/cve-2026-115968-deserialization-of-untrusted-data-vulnerability-in-ultimate)
- [Ultimate Member WordPress plugin Stored XSS in user_url parameter](https://junglewise.ai/threats/cve-2026-107625-the-ultimate-member-user-profile-registration-login-member)
- [Ultimate Member privilege escalation in role assignment](https://junglewise.ai/threats/cve-2026-96539-incorrect-privilege-assignment-vulnerability-in-ultimate-member)
- [Ultimate Member privilege escalation in user authorization](https://junglewise.ai/threats/cve-2026-96451-authorization-bypass-through-user-controlled-key-vulnerability-in)