What’s Vulnerable › Vulnerabilities
CVE-2026-11766: Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
- Severity: high (CVSS 8.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-06 · updated 2026-07-06
Description
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Affected products
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P: before 2.12.0 — fixed in 2.12.0
How to fix
Upgrade to a fixed version: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership P 2.12.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11766 or the next vulnerability affects your stack