CVE-2025-13220 is a stored cross-site scripting vulnerability in the Ultimate Member WordPress plugin (up to version 2.11.0). It arises from improper neutralization of input in shortcode attributes, allowing authenticated users with Contributor-level privileges or above to inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to data theft or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and limited privileges required but no user interaction needed. No known exploits in the wild or vendor patches are currently documented.

The vulnerability allows authenticated users with Contributor-level access or higher to inject and store malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no direct impact on availability. The medium severity score reflects these impacts and the required privilege level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access carefully and consider disabling or limiting use of shortcode attributes in the plugin. Monitor for updates from the Ultimate Member plugin vendor and apply patches promptly once released.