CVE-2026-85680 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Ultimate Member WordPress plugin versions prior to 2.13.1. The vulnerability occurs because the plugin does not escape values derived from user-supplied profile names before rendering them in the page title. Additionally, it decodes HTML entities after its own sanitization process, enabling attackers who can register accounts to store malicious JavaScript payloads. These scripts execute in the context of any user viewing the attacker's profile page, potentially leading to session hijacking or other client-side attacks.

An unauthenticated attacker can register an account and inject JavaScript code that executes in the browsers of any visitors viewing the attacker's profile page, including administrators. This can lead to client-side attacks such as session hijacking, defacement, or other malicious actions executed with the privileges of the victim user.

Upgrade the Ultimate Member plugin to version 2.13.1 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, no additional mitigation steps are required if the plugin is updated.