PT-2026-55865 · WordPress · Ultimate Member

Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-11766

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.12.0

Description Insufficient sanitization and escaping of custom textarea profile fields allow authenticated users with Subscriber-level access and above to perform a stored cross-site scripting attack. This occurs when JavaScript is stored in the profile and subsequently executes when any user, including an administrator, views the affected profile.

Recommendations Update to version 2.12.0 or later.

Exploit

Fix

Related Identifiers

CVE-2026-11766

Affected Products

Ultimate Member

References · 2

• 🔥 https://wpscan.com/vulnerability/96adb2d3-af34-4455-97d4-90af58049e78 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11766 · Security Note