CVE-2026-107625 in Ultimate Member Plugin
Summary
by MITRE • 10/28/2026
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in The Ultimate Member plugin for WordPress represents a significant security risk stemming from insufficient input sanitization and output escaping mechanisms within the user_url parameter. This flaw allows authenticated attackers, possessing subscriber-level access or higher privileges, to inject arbitrary web scripts into pages that are subsequently viewed by other users. Unlike reflected cross-site scripting where malicious code is executed immediately upon request processing, this stored variant persists in the database, ensuring that every time a victim accesses the compromised profile page containing the injected script, the payload executes within their browser context. The root cause lies in the plugin's failure to properly validate and escape user-supplied data before rendering it on public-facing pages, creating an avenue for persistent malicious code injection.
The operational impact of this vulnerability is severe due to its ability to facilitate account takeover, session hijacking, or defacement attacks against unsuspecting visitors. Since the attack requires only that a victim clicks on the attacker's website URL link displayed on their public Ultimate Member profile, and given that redirect-confirmation onclick handlers are enabled by default in new installations, the condition for successful exploitation is trivially met. This design choice significantly lowers the barrier to entry for attackers, as it removes any friction or warning mechanisms that might otherwise alert users to potential phishing attempts or malicious redirects. Consequently, this vulnerability can be leveraged to steal sensitive information such as session cookies, personal data, or administrative credentials if those are accessible within the victim's browser context during execution of the injected script.
From a classification perspective, this issue aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under stored XSS where malicious scripts are permanently stored on target servers and executed whenever users request the affected data. In terms of attack vectors mapped to MITRE ATT&CK framework, this vulnerability corresponds to techniques involving client-side code injection such as T1059 which covers command and script interpretation through browser-based execution. The persistence aspect also relates to T1189 Drive-by Compromise where victims are compromised via interactions with seemingly benign web content like profile links.
Mitigation strategies should focus on immediate remediation of the input validation and output escaping processes within the plugin codebase. Developers must implement strict whitelisting for allowed characters in URL fields and ensure that all user-generated content is properly escaped using context-aware encoding techniques before being rendered in HTML, JavaScript, or CSS contexts. Additionally, enabling Content Security Policy headers can help mitigate the impact of any successfully injected scripts by restricting sources from which executable code may be loaded. For administrators currently running versions up to 2.14.0, upgrading to a patched version that addresses these sanitization flaws is critical. Until an update is available, manually reviewing and cleaning user profiles for suspicious URL entries can reduce exposure while also disabling the default redirect-confirmation feature if possible to add an extra layer of defense against accidental clicks on malicious links.