CVE-2026-116621

Name of the Vulnerable Software and Affected Versions Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.14.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the pm note parameter (or any custom Textarea metakey with HTML disabled), enabling the injection of arbitrary web scripts. Exploitation requires a privileged user to click an attacker-rendered anchor on a target profile page, which triggers a DOM gadget that concatenates the unescaped data-src value into an HTML string processed by jQuery.

Recommendations Update the plugin to version 2.14.2 or later.