CVE-2026-85680— Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
Quick assessment
Affected
Unknown Ultimate Member
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 The Ultimate Member 在 2.13.1 版本之前，未在输出用户输入的 profile 名称到页面标题时对其进行转义，并且在其自身的清理（sanitisation）流程执行完毕后，又对其中包含的 HTML 实体进行解码。这使得未认证的、仅通过注册账号的攻击者能够存储 JavaScript 代码，当任何访客（包括管理员）查看该用户的个人资料页面时，该 JavaScript 将会执行。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85680
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
Source: CVE Program / CVE List V5
Vulnerability Description
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Ultimate Member | 0 ~ 2.13.1 | - |
|
II. Public POCs for CVE-2026-85680
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85680
请登录查看更多情报信息。
Vendor Pages for CVE-2026-85680 (1)
-
🔗 Ultimate Member < 2.13.1 – Unauthenticated Stored XSS via Profile Page Title | CVE 2026-85680 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-19 · 21 CVEs total
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | |
| CVE-2026-19860 | JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validati | |
| CVE-2026-16557 | Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_con | |
| CVE-2026-84750 | Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-76554 | WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import | |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | |
| CVE-2026-85574 | Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unb | |
| CVE-2026-86591 | Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder R | |
| CVE-2026-86814 | UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider | |
| CVE-2026-92435 | Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API | |
| CVE-2026-92099 | WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squ | |
| CVE-2026-88824 | Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings | |
| CVE-2026-88926 | VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi | |
| CVE-2026-92404 | MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure | |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Sub | |
| CVE-2026-92430 | Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webh |
IV. Related Vulnerabilities
Same product: Ultimate Member
-
CVE-2026-19251
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Commen -
CVE-2026-19423
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege E -
CVE-2026-12251
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalat -
CVE-2026-11766
Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom -
CVE-2025-47691
WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Funct
Same vendor: Unknown
-
CVE-2026-92435
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken A -
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order St -
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modifica -
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Tak -
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Delet
V. Comments for CVE-2026-85680
No comments yet