Medium severity · published Feb 18, 2026
CVE-2026-1404
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UM
Affected product
UM
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
ultimatemember
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1404
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/assets/js/um-members.js#L515
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/templates/members.php#L348
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3458086/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=cve
More from Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
8.8
CVE-2026-7761
Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
8.0
CVE-2026-4248
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
7.5
CVE-2026-93428
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
7.5
CVE-2026-15290
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection
7.2
CVE-2026-96270
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter