# Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via URL Profile Field

- **ID:** WPSEC-2026-1582
- **Plugin:** Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (`ultimate-member`), https://wordpress.org/plugins/ultimate-member/
- **Affected versions:** from 2.3.2 before 2.14.1
- **Fixed in:** 2.14.1 (Update to 2.14.1 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ultimate-member
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1582/

## Description

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL profile field values in all versions up to, and including, 2.14.0, due to insufficient escaping of the value placed inside the inline onclick confirmation handler that is added to external links when the 'Allow external link redirect confirm' option is enabled, which it is by default. The value is escaped with esc_js() inside a double-quoted JavaScript string in an HTML attribute, and double quotes encoded as HTML entities are decoded back by the browser before the handler runs, so the value can break out of the JavaScript string. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their profile that execute when another user, such as an administrator, clicks the link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1582/
- https://plugins.svn.wordpress.org/ultimate-member/tags/2.14.1/
- https://wordpress.org/plugins/ultimate-member/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1582/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.