CVE-2026-11766 is a stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member WordPress plugin prior to version 2.12.0. The issue arises because the plugin does not correctly sanitize and escape the values of custom textarea profile fields before rendering them on user profiles. Authenticated users with Subscriber-level or higher privileges can exploit this to store JavaScript code that executes in the context of any user viewing the profile, potentially leading to session hijacking or other malicious actions.

An attacker with Subscriber-level access or higher can inject malicious JavaScript into user profile fields. This script executes when any user, including administrators, views the compromised profile, potentially allowing the attacker to perform actions such as stealing session cookies or performing actions on behalf of the victim user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict profile editing permissions to trusted users only and consider disabling custom textarea profile fields if possible to reduce exposure.