Description

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-19T07:16:32.960Z",
  "pubdate": "2026-09-19T07:16:32.960Z",
  "executiveSummary": "The Ultimate Member WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output encoding of user-supplied profile names.\nThis vulnerability allows unauthenticated attackers to register an account and inject malicious JavaScript payloads into their profile metadata.\nThe vulnerability resides in the way the application processes profile names for display within the HTML page title element.\nWhen a victim, including an administrator with higher privileges, views the crafted profile, the payload is executed within the context of the victim's browser session.\nSuccessful exploitation facilitates unauthorized actions, potential session hijacking, or administrative account takeover by leveraging the trust associated with the WordPress site's domain.\nAffected systems include Ultimate Member versions prior to 2.13.1.\nThe risk is considered high due to the potential for cross-site scripting attacks to bypass standard security controls if not remediated.",
  "technicalDetails": "The vulnerability stems from a flaw in how the Ultimate Member plugin handles and sanitizes user-supplied profile names before rendering them in the page title.\nThe root cause is a two-fold failure: first, a failure to properly escape output in the context of an HTML title tag; and second, the subsequent decoding of HTML entities after the initial sanitization logic has been applied.\nBy decoding entities post-sanitization, the plugin effectively neuters previous security checks, allowing the browser to parse and execute encoded script tags.\nAn attacker can exploit this by registering a new user account on a WordPress site utilizing the Ultimate Member plugin. During the registration process or profile update, the attacker sets their profile name to include a malicious JavaScript payload, such as <script>alert(document.cookie)</script>.\nWhen a user or administrator navigates to the attacker’s profile page, the application dynamically generates the page title using the malicious input.\nBecause the input is not correctly escaped when rendered in the <title> tag and the HTML decoding logic processes the injected characters, the browser executes the script immediately upon page load.\nThe attack flow follows a predictable pattern: 1) The attacker initiates an account registration process. 2) The attacker submits a malicious string as the profile name, which is stored in the site database. 3) The vulnerability is triggered when a victim visits the attacker's public profile page. 4) The plugin retrieves the malicious string, decodes entities, and injects the raw payload into the page's document head. 5) The victim's browser executes the payload.\nSince this is a Stored XSS vulnerability, the payload persists until the profile data is manually corrected or purged from the database. The impact is significant, as it can be used to perform actions on behalf of the victim, exfiltrate sensitive session tokens, or redirect users to malicious external domains. Because the vulnerability allows unauthenticated registration, any visitor can potentially trigger this exploit on the server.\nThe affected component is the profile management and display module of the Ultimate Member plugin, specifically within the logic that dynamically sets the HTML title attribute based on profile data."
}