{"id":"CVE-2026-107625","kind":"vulnerability","aliases":["CVE-2026-107625"],"related":[],"title":"Ultimate Member WordPress plugin: stored XSS via profile website URL","description":"The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.","summary":"The Ultimate Member WordPress plugin up to and including 2.14.0 does not sanitize the user_url profile field. An authenticated subscriber can store a script there that runs in the browser of any visitor who clicks the website link on their public profile.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","ultimate-member","wordpress"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Ultimate Member plugin version in the WordPress admin plugins list or with `wp plugin get ultimate-member --field=version`\n- Confirm whether the site allows subscriber-level registration with public member profiles enabled","fix":"- Update the Ultimate Member plugin to a version later than `2.14.0` once the vendor release is confirmed (unknown in sources)","status":"open","published_at":"2026-10-28T03:17:08+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:40+00:00","updated_at":"2026-10-28T03:32:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T03:32:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ultimate Member plugin to a version later than `2.14.0` once the vendor release is confirmed (unknown in sources)","reach":"internet","title":"Ultimate Member WordPress plugin: stored XSS via profile website URL","impact":"medium","summary":"The Ultimate Member WordPress plugin up to and including 2.14.0 does not sanitize the user_url profile field. An authenticated subscriber can store a script there that runs in the browser of any visitor who clicks the website link on their public profile.","category":"package","nicknames":[],"who_cares":["wordpress","ultimate-member","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Fixed version and exact patch release unknown from the NVD entry; check the plugin changelog or WPScan for the first fixed version.","how_to_check":"- Check the installed Ultimate Member plugin version in the WordPress admin plugins list or with `wp plugin get ultimate-member --field=version`\n- Confirm whether the site allows subscriber-level registration with public member profiles enabled","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Sites running the Ultimate Member plugin at version 2.14.0 or earlier that allow users to register and edit a website URL on public profiles. Sites without public member profiles or without open registration are less exposed. Sites on newer plugin versions can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3468,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107625':13A,16A '-2026':12A,15A '2.14.0':34B,104C 'access':124C,140C 'arbitrari':129C 'attack':119C,152C 'authent':44B,118C 'browser':55B 'click':60B,150C 'condit':164C 'confirm':173C 'content':77C 'cross':89C 'cross-sit':88C 'cve':11A,14A 'default':179C 'directori':76C 'due':105C 'enabl':177C 'escap':112C 'execut':136C 'exploit':145C 'field':42B 'handler':175C 'host':20B 'includ':33B,103C 'inject':128C,142C 'input':108C 'instal':183C 'insuffici':107C 'level':123C 'link':63B,156C 'login':74C 'make':114C 'member':2A,23B,27B,70C,75C,161C 'membership':79C 'met':168C 'new':182C 'onclick':174C 'output':111C 'packag':17B 'page':133C,143C 'paramet':96C 'plugin':4A,29B,80C,81C 'possibl':116C 'profil':8A,41B,67B,72C,162C 'public':66B,159C 'redirect':172C 'redirect-confirm':171C 'registr':73C 'requir':146C 'restrict':78C 'run':52B 'sanit':37B,109C 'script':49B,91C,131C 'self':19B 'self-host':18B 'sinc':169C 'site':90C 'store':5A,47B,87C 'subscrib':45B,122C 'subscriber-level':121C 'success':144C 'trivial':167C 'ultim':1A,22B,26B,69C,160C 'ultimate-memb':21B 'url':10A,40B,95C,155C 'user':39B,71C,94C,139C 'version':99C 'via':7A,92C 'visitor':58B,148C 'vulner':85C 'web':130C 'websit':9A,62B,154C 'whenev':137C 'wordpress':3A,24B,28B,83C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Member plugin at version 2.14.0 or earlier that allow users to register and edit a website URL on public profiles. Sites without public member profiles or without open registration are less exposed. Sites on newer plugin versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107625","severity":null,"published_at":"2026-10-28T03:17:08+00:00","modified_at":"2026-10-28T03:17:08+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}