CVE-2018-13136: Improper Neutralization of Input During Web Page Generation

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...