CVE-2026-18547: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

The Ultimate Member plugin for WordPress (versions up to and including 2.12.1) suffers from a stored cross-site scripting vulnerability (CWE-79) in the Textarea Profile Field with HTML support. The root cause is insufficient sanitization and escaping of the id attribute on div elements allowed by the wp_kses templates allowlist. Unescaped quotes in the id attribute enable attackers to inject onfocus and autofocus attributes that break out of the attribute context and execute arbitrary JavaScript when the profile page loads. This is triggered when pickadate.js concatenates the stored id value into an HTML string via jQuery's .html() method. The vulnerability requires authenticated access at subscriber level or above and does not require user interaction (UI:N).

An authenticated attacker with subscriber-level or higher privileges can inject persistent malicious scripts into profile pages. These scripts execute automatically when other users view the injected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability affects confidentiality and integrity but not availability. The CVSS 3.1 base score is 6.4, indicating medium severity.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level users from modifying profile fields that accept HTML or disable HTML support in profile fields if possible. Monitor updates from the Ultimate Member plugin vendor for an official fix.