Vulnerability details
CVE-2026-85680
Ultimate Member
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
CVSS 3.1
8.8High
Official description
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | Ultimate Member | v < 2.13.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/a49b734f-2244-4d6f-8912-b4ce6ba9eb0f/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-19
- Last updated
- 2026-09-19
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.5%
Probability of exploitation in 30 days
43.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')