CVE-2026-85680: Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by registering an account and supplying a crafted profile name. The payload runs when another visitor views the attacker’s profile page, including an administrator.
Are sites affected if public user registration is disabled?
The described attack requires the attacker to register an account. The provided information does not identify another exploitation path.
What version resolves the issue?
Upgrade Ultimate Member to version 2.13.1 or later. Versions before 2.13.1 are affected.
What can be done while an upgrade is not immediately possible?
Disable or restrict account registration to prevent unauthenticated attackers from creating profiles. Review existing profile names for malicious content and avoid visiting suspicious user profile pages until remediation is applied.