CVE-2026-11766

Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields

High · published July 6, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.6th percentile
Published
2026-07-06T06:00Z
EPSS history
Timeline
  • 06 JUL 06:00Z
    Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
    cvelistv5