---
id: "CVE-2026-116621"
page: "https://infrastack.ai/live/CVE-2026-116621"
kind: "vulnerability"
aliases: ["CVE-2026-116621"]
title: "WordPress Ultimate Member plugin: stored XSS via profile note field"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "ultimate-member", "wordpress"]
not_affected_if: ["default-config", "no-public-registration"]
published_at: "2026-11-07T07:17:02+00:00"
first_seen_at: "2026-11-07T07:46:06+00:00"
updated_at: "2026-11-07T07:47:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116621", "first_seen_at": "2026-11-07T07:46:06+00:00"}]
exploit_sources: []
---

# WordPress Ultimate Member plugin: stored XSS via profile note field

Link for people: https://infrastack.ai/live/CVE-2026-116621 (this .md is for agents)

The Ultimate Member WordPress plugin does not sanitize the pm_note custom textarea field, so a logged-in subscriber can store script that runs in other users' browsers. Exploitation requires a privileged user to click an attacker-rendered link on a profile page, which then triggers the script.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ultimate Member plugin version in the WordPress admin Plugins screen; versions up to and including `2.14.1` are affected.
- Look for custom Textarea metakeys with HTML disabled on member profile forms.

## Timeline

- 2026-11-07T07:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116621

## Documents

- [fix] Release notes: github.com https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.2

## From the sources

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_