CVE-2026-85680

Received Received - Intake

Unauthenticated Stored XSS in Ultimate Member WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-85680

Affected Vendors & Products

Vendor	Product	Version / Range
ultimate_member	ultimate_member	to 2.13.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The Ultimate Member WordPress plugin before version 2.13.1 has a flaw where user-supplied profile names are not properly escaped before being displayed in the page title. Additionally, HTML entities in these names are decoded after the plugin's own sanitization, allowing unauthenticated attackers to inject JavaScript code. This script executes when any visitor, including administrators, views the attacker's profile.

Detection Guidance

This vulnerability can be detected by checking the installed version of the Ultimate Member plugin. If the version is below 2.13.1, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

Unauthenticated attackers can register an account and store malicious JavaScript in their profile name. When an administrator or other user views the attacker's profile, the injected script executes. This could lead to unauthorized actions, data theft, or further compromise of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Immediately update the Ultimate Member plugin to version 2.13.1 or later. If updating is not possible, consider temporarily disabling the plugin until the update is applied to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-85680. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70