CVE-2026-18547

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions prior to 2.12.2

Description Stored Cross-Site Scripting occurs via the Textarea Profile Field with HTML Support due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. This happens because the wp kses templates allowlist permits the id attribute on div elements without neutralizing unescaped quotes. When pickadate.js concatenates the stored id value into an HTML string using the jQuery .html() function during profile page load, smuggled onfocus and autofocus attribute syntax can break the attribute context and execute as JavaScript.

Recommendations Update to a version newer than 2.12.1.