CVE-2026-18547

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547 Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

EUVD-2026-65460

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-18547

CVE-2026-18547 affects the Ultimate Member WordPress plugin in all versions up to and including 2.12.1 . Authenticated attackers with subscriber-level access or above can exploit a stored XSS (DOM-based) by injecting malicious JavaScript through a textarea profile field with HTML support. The roo...

PT-2026-81267

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.12.2 Description Stored Cross-Site Scripting occurs via the Textarea Profile Field with HTML Support due to...