High severity · published Sep 19, 2026
CVE-2026-85680
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UM
Ultimate Member ·
before 2.13.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85680
wpscan.com
https://wpscan.com/vulnerability/a49b734f-2244-4d6f-8912-b4ce6ba9eb0f/
More from Ultimate Member
9.8
CVE-2023-3460
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
8.1
CVE-2026-19423
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
8.1
CVE-2026-12251
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
8.0
CVE-2026-11766
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields
5.3
CVE-2026-19251
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity