Now officially on WordPress.org

CVE Database / CVE-2026-11766

CVE

CVE-2026-11766 — Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-11766 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin [ultimate-member] < 2.12.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Unknown < 2.12.0 2.12.0 2026-07-06 —

CVE-2026-11766

Authenticated users with a minimum role of Subscriber can inject malicious JavaScript into custom textarea profile fields in Ultimate Member plugin versions prior to 2.12.0, which is then executed when another user, potentially an admin, views the affected profile. This vulnerability stems from inadequate sanitization and escaping of these field values before displaying them on user profiles. As a result, attackers can leverage this flaw for cross-site scripting attacks.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings