CVE-2026-116621 · Package
NO FIX YET
The Ultimate Member WordPress plugin does not sanitize the pm_note custom textarea field, so a logged-in subscriber can store script that runs in other users' browsers. Exploitation requires a privileged user to click an attacker-rendered link on a profile page, which then triggers the script.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Ultimate Member plugin up to and including 2.14.1 that accept subscriber-level accounts and show profile pages to administrators or other privileged users. Sites without open member registration or without custom textarea fields on profiles are less exposed. The sources do not give a fixed version beyond the release notes link.
Not affected if default-config, no-public-registration
Who cares self-hosted, ultimate-member, wordpress
2.14.1 are affected.No fix yet, per the sources.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.