Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Profile Field
- ID
- WPSEC-2026-1582
- Plugin
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (ultimate-member)
- Affected
- from 2.3.2 before 2.14.1
- Remediation
- Update to 2.14.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-24
- Attack surface
- Ultimate Member on WPSec AttackSurface
- Fix released
- Published
Description
The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL profile field values in all versions up to, and including, 2.14.0, due to insufficient escaping of the value placed inside the inline onclick confirmation handler that is added to external links when the 'Allow external link redirect confirm' option is enabled, which it is by default. The value is escaped with esc_js() inside a double-quoted JavaScript string in an HTML attribute, and double quotes encoded as HTML entities are decoded back by the browser before the handler runs, so the value can break out of the JavaScript string. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their profile that execute when another user, such as an administrator, clicks the link.
References
- https://wpsec.com/vuln/WPSEC-2026-1582/
- https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.1/
- https://wordpress.org/plugins/ultimate-member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS