CVE-2026-11766

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, includin...

CVE-2026-11766

The Ultimate Member WordPress plugin (versions before 2.12.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from the failure to properly sanitise and escape values provided in custom textarea profile fields before they are displayed on user profiles. This allows auth...