CVE-2026-11766high

CVE-2026-11766: falha de alta gravidade em Ultimate Member

Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields

Publicada em

Seguir esta CVE+ Monitorar Ultimate Member

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8epss 0.4%
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Ultimate Member
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Ultimate Member

No mesmo produto, das mais perigosas para as menos.

CVE-2023-3460—Ultimate Member < 2.6.7 - Unauthenticated Privilege EscalationEPSS 72.3%CVE-2026-85680HIGHUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleEPSS 0.5%CVE-2026-19423HIGHUltimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile FormsEPSS 0.4%CVE-2026-12251HIGHUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldEPSS 0.4%CVE-2026-19251MEDIUMUltimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile ActivityEPSS 0.3%