CVE-2026-85680

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.1

Description An issue exists where the plugin fails to escape a value derived from user-supplied profile names before outputting it in the page title. Additionally, the software decodes HTML entities after the sanitization process has already been executed. This allows unauthenticated attackers who register an account to store JavaScript that executes when any visitor, including an administrator, views the affected profile.

Recommendations Update Ultimate Member WordPress plugin to version 2.13.1 or later.