{
 "id": "WPSEC-2026-1582",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1582/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1582/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1582/index.md",
 "title": "Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Profile Field",
 "description": "The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL profile field values in all versions up to, and including, 2.14.0, due to insufficient escaping of the value placed inside the inline onclick confirmation handler that is added to external links when the 'Allow external link redirect confirm' option is enabled, which it is by default. The value is escaped with esc_js() inside a double-quoted JavaScript string in an HTML attribute, and double quotes encoded as HTML entities are decoded back by the browser before the handler runs, so the value can break out of the JavaScript string. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their profile that execute when another user, such as an administrator, clicks the link.",
 "plugin": {
  "slug": "ultimate-member",
  "name": "Ultimate Member",
  "full_name": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
  "wordpress_org": "https://wordpress.org/plugins/ultimate-member/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ultimate-member/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ultimate-member"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.3.2",
    "from_inclusive": true,
    "to": "2.14.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.3.2 before 2.14.1"
  ]
 },
 "introduced_in": "2.3.2",
 "fixed_in": "2.14.1",
 "remediation": "Update to 2.14.1 or later.",
 "fix_released": "2026-10-23T05:34:05+00:00",
 "published": "2026-10-24T05:45:10+00:00",
 "updated": "2026-10-23T09:45:20.172574+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1582/",
  "https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.1/",
  "https://wordpress.org/plugins/ultimate-member/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ultimate-member",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-24"
 }
}