{"id":"CVE-2026-116621","kind":"vulnerability","aliases":["CVE-2026-116621"],"related":[],"title":"WordPress Ultimate Member plugin: stored XSS via profile note field","description":"The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery.","summary":"The Ultimate Member WordPress plugin does not sanitize the pm_note custom textarea field, so a logged-in subscriber can store script that runs in other users' browsers. Exploitation requires a privileged user to click an attacker-rendered link on a profile page, which then triggers the script.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","ultimate-member","wordpress"],"not_affected_if":["default-config","no-public-registration"],"how_to_check":"- Check the installed Ultimate Member plugin version in the WordPress admin Plugins screen; versions up to and including `2.14.1` are affected.\n- Look for custom Textarea metakeys with HTML disabled on member profile forms.","fix":null,"status":"open","published_at":"2026-11-07T07:17:02+00:00","first_seen_at":"2026-11-07T07:46:06+00:00","triaged_at":"2026-11-07T07:47:12+00:00","updated_at":"2026-11-07T07:47:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T07:47:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Ultimate Member plugin: stored XSS via profile note field","impact":"medium","summary":"The Ultimate Member WordPress plugin does not sanitize the pm_note custom textarea field, so a logged-in subscriber can store script that runs in other users' browsers. Exploitation requires a privileged user to click an attacker-rendered link on a profile page, which then triggers the script.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ultimate-member","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in a privileged user's browser on the site","analyst_note":"Confirm the fixed version from the release notes link (github.com) and the plugin's changelog; sources do not state it.","how_to_check":"- Check the installed Ultimate Member plugin version in the WordPress admin Plugins screen; versions up to and including `2.14.1` are affected.\n- Look for custom Textarea metakeys with HTML disabled on member profile forms.","plain_action":"","needs_analyst":true,"not_affected_if":["no-public-registration","default-config"],"who_is_affected":"Sites running the Ultimate Member plugin up to and including 2.14.1 that accept subscriber-level accounts and show profile pages to administrators or other privileged users. Sites without open member registration or without custom textarea fields on profiles are less exposed. The sources do not give a fixed version beyond the release notes link.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4405,"output_tokens":569,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116621':13A,16A '-2026':12A,15A '2.14.1':118C 'access':138C,154C 'anchor':170C 'arbitrari':143C 'attack':63B,133C,168C 'attacker-rend':62B,167C 'authent':132C 'browser':53B 'click':60B,165C 'concaten':182C 'content':84C 'cross':96C 'cross-sit':95C 'custom':36B,104C 'cve':11A,14A 'data':186C 'data-src':185C 'directori':83C 'disabl':109C 'dom':179C 'due':119C 'escap':126C 'execut':150C 'exploit':54B,159C 'field':10A,38B 'gadget':180C 'host':20B 'html':108C,191C 'includ':117C 'inject':142C,156C 'input':122C 'insuffici':121C 'jqueri':195C 'level':137C 'link':65B 'log':42B 'logged-in':41B 'login':81C 'make':128C 'member':3A,23B,27B,77C,82C 'membership':86C 'metakey':106C 'note':9A,35B,102C 'output':125C 'packag':17B 'page':69B,147C,157C,175C 'paramet':110C 'pass':193C 'plugin':4A,29B,87C,88C 'pm':34B,101C 'possibl':130C 'privileg':57B,162C 'profil':8A,68B,79C,174C 'registr':80C 'render':64B,169C 'requir':55B,160C 'restrict':85C 'run':49B 'sanit':32B,123C 'script':47B,74B,98C,145C 'self':19B 'self-host':18B 'site':97C 'src':187C 'store':5A,46B,94C 'string':192C 'subscrib':44B,136C 'subscriber-level':135C 'success':158C 'target':173C 'textarea':37B,105C 'trigger':72B,177C 'ultim':2A,22B,26B,76C 'ultimate-memb':21B 'unescap':184C 'user':52B,58B,78C,153C 'valu':188C 'version':113C 'via':7A,99C 'victim':163C 'vulner':92C 'web':144C 'whenev':151C 'wordpress':1A,24B,28B,90C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ultimate Member plugin up to and including 2.14.1 that accept subscriber-level accounts and show profile pages to administrators or other privileged users. Sites without open member registration or without custom textarea fields on profiles are less exposed. The sources do not give a fixed version beyond the release notes link.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","ultimatemember","wordpress"],"campaign_type":null,"search_a":"'-116621':13A,16A '-2026':12A,15A 'cve':11A,14A 'field':10A 'member':3A 'note':9A 'plugin':4A 'profil':8A 'store':5A 'ultim':2A 'via':7A 'wordpress':1A 'xss':6A","search_b":"'attack':63B 'attacker-rend':62B 'browser':53B 'click':60B 'custom':36B 'exploit':54B 'field':38B 'host':20B 'link':65B 'log':42B 'logged-in':41B 'member':23B,27B 'note':35B 'packag':17B 'page':69B 'plugin':29B 'pm':34B 'privileg':57B 'profil':68B 'render':64B 'requir':55B 'run':49B 'sanit':32B 'script':47B,74B 'self':19B 'self-host':18B 'store':46B 'subscrib':44B 'textarea':37B 'trigger':72B 'ultim':22B,26B 'ultimate-memb':21B 'user':52B,58B 'wordpress':24B,28B","search_c":"'2.14.1':118C 'access':138C,154C 'anchor':170C 'arbitrari':143C 'attack':133C,168C 'attacker-rend':167C 'authent':132C 'click':165C 'concaten':182C 'content':84C 'cross':96C 'cross-sit':95C 'custom':104C 'data':186C 'data-src':185C 'directori':83C 'disabl':109C 'dom':179C 'due':119C 'escap':126C 'execut':150C 'exploit':159C 'gadget':180C 'html':108C,191C 'includ':117C 'inject':142C,156C 'input':122C 'insuffici':121C 'jqueri':195C 'level':137C 'login':81C 'make':128C 'member':77C,82C 'membership':86C 'metakey':106C 'note':102C 'output':125C 'page':147C,157C,175C 'paramet':110C 'pass':193C 'plugin':87C,88C 'pm':101C 'possibl':130C 'privileg':162C 'profil':79C,174C 'registr':80C 'render':169C 'requir':160C 'restrict':85C 'sanit':123C 'script':98C,145C 'site':97C 'src':187C 'store':94C 'string':192C 'subscrib':136C 'subscriber-level':135C 'success':158C 'target':173C 'textarea':105C 'trigger':177C 'ultim':76C 'unescap':184C 'user':78C,153C 'valu':188C 'version':113C 'via':99C 'victim':163C 'vulner':92C 'web':144C 'whenev':151C 'wordpress':90C","first_public_at":"2026-11-07T07:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116621","severity":null,"published_at":"2026-11-07T07:17:02+00:00","modified_at":"2026-11-07T07:17:02+00:00","first_seen_at":"2026-11-07T07:46:06+00:00","fetched_at":"2026-11-07T07:46:06+00:00","note":null}],"documents":[{"id":93841,"url":"https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}