CVE-2021-24306: Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-24 · updated 2026-06-17
Weakness: CWE-79

Description

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.

Affected products

ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P: before 2.1.20 — fixed in 2.1.20

How to fix

Upgrade to a fixed version: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P 2.1.20. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24306 or the next vulnerability affects your stack