Executive brief
The Ultimate Member WordPress plugin allows unauthenticated users to register accounts and inject malicious JavaScript into their profile names. When administrators or other visitors view an attacker's profile, the stored JavaScript executes in their browsers, potentially compromising their accounts or stealing sensitive data. This affects all installations of the plugin before version 2.13.1.
Technical details
The plugin fails to properly escape user-supplied profile names before outputting them in the page title and performs HTML entity decoding after its own sanitization, allowing stored XSS. An unauthenticated attacker who registers an account can inject JavaScript payloads that persist in the database and execute when any visitor, including administrators, views the profile. The vulnerability is triggered via profile page rendering and requires only account registration.
Affected products
- Ultimate Member Ultimate Member before 2.13.1
Timeline
- 2026-09-17: disclosed: Publicly disclosed vulnerability
- 2026-09-XX: patched: Fixed in version 2.13.1