CVE-2026-96270

Name of the Vulnerable Software and Affected Versions Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.13.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via the form id parameter. The malicious payload is stored in the registering user's submitted usermeta through the update user meta() function. The script executes when an administrator views the affected user record in the wp-admin Users modal, which inserts the unescaped output using the jQuery .html() method.

Recommendations Update the plugin to version 2.13.2 or later.