CVE Database /
CVE-2025-15064
CVE · Medium
CVE-2025-15064 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-15064
|
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.11.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 2.11.2
|
2.11.2 |
2026-04-03 |
—
|
CVE-2025-15064
The Ultimate Member plugin for WordPress contains a security flaw affecting all versions up to 2.11.1, where user input in the profile description field isn't properly cleaned before being displayed on pages. This weakness allows attackers with subscriber-level access or higher to embed malicious scripts into user profiles that will run when viewed by other users. The vulnerability can only be exploited if HTML is enabled for user descriptions within Ultimate Member's settings.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings