CVE-2026-11766
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Risk Assessment
An attacker can inject malicious scripts that hijack administrator sessions, steal data, or perform unauthorized actions in the context of the administrator account, leading to full compromise of the WordPress site.
Recommendation
Immediately update the Ultimate Member plugin to version 2.12.0 or later. Additionally, restrict permissions to edit custom profile fields to trusted users only.
Original NVD description (English source)
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.