---
id: CVE-2026-107625
title: >-
  Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site
  Scripting via 'user_url' Profile Field
summary: >-
  The Ultimate Member – User Profile, Registration, Login, Member Directory,
  Content Restriction & Membership Plugin plugin for WordPress is vulnerable to
  Stored Cross-Site Scripting via the 'user_url' parameter in all versions up
  to, and …
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: ultimatemember
product: >-
  Ultimate Member – User Profile, Registration, Login, Member Directory, Content
  Restriction & Membership Plugin
affected:
  - >-
    ultimate_member_user_profile_registration_login_member_directory_content_restriction_membership_plugin
    <= 2.14.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T14:35:45.607186Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:11:08.360Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107625'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/8180160d-ba33-4f79-baa5-2613be470b0f?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L519
  - url: >-
      https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L522
  - url: >-
      https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-form.php#L896
  - url: 'https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.1'
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.0898
ingestedAt: '2026-10-28T03:02:57.616Z'
---

## Overview

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations.

## Affected

- `ultimate_member_user_profile_registration_login_member_directory_content_restriction_membership_plugin <= 2.14.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.