CVE-2026-11766 is a stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member WordPress plugin versions prior to 2.12.0. The vulnerability arises because the plugin does not properly sanitize and escape the values of custom textarea profile fields before rendering them on user profiles. Authenticated users with Subscriber-level privileges or above can exploit this to inject JavaScript code that executes in the context of any user viewing the profile, potentially leading to full compromise of confidentiality, integrity, and availability of the affected site.

Successful exploitation allows an authenticated user with low privileges to execute arbitrary JavaScript in the browsers of users who view the compromised profile, including administrators. This can lead to theft of sensitive information, session hijacking, and potentially full site compromise. The CVSS score of 8.0 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict profile editing permissions to trusted users only and consider disabling custom textarea profile fields if possible. Monitor for updates from the Ultimate Member plugin vendor and apply official patches promptly once released.