WordPress Ultimate Member plugin <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via DOM Gadgets vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.11.1...

CVE-2025-15064 Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization a...