Ultimate Member profile names bypass output sanitization
An attacker able to register an account supplies a malicious profile name. HTML entities are decoded after sanitization and the result is emitted unescaped in the profile page title, executing script when another visitor or administrator views that profile. Registration is a prerequisite even though the record describes the attacker as unauthenticated. The exact rendering function is not disclosed. Authoritative affected range: < 2.13.1. Confirmed remediation: 2.13.1.
- Component
- Ultimate Member
- Plugin slug
ultimate-member- Affected
- < 2.13.1
- Safe version
2.13.1- Published
- Sep 19, 2026
This CVE was published Sep 19, 2026 and is one of 68 known issues for this plugin.
Update, patch or deactivate.
Update to the applicable fixed release identified in the authoritative export: 2.13.1. Restrict registration or profile viewing until updated. Normalize names before validation and escape the final title after decoding; remove malicious saved names and avoid introducing executable markup through later transformations.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H