CVE-2026-107625: Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userurl' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They can place a malicious value in the user_url profile field on a public Ultimate Member profile.
Does exploitation require a non-default configuration?
No. The redirect-confirmation onclick handler that enables the attack path is enabled by default on new installations.
What user interaction is required for the payload to execute?
A visitor must click the attacker's Website URL link on the attacker's public Ultimate Member profile. The injected script then executes in the visitor's browser.
Which versions are affected?
All versions up to and including 2.14.0 are affected.