CVE-2026-116621

Description

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 6.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Effective score: 6.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-79
Reserved: 2026-10-26
Published: 2026-11-07 06:39 UTC
Last updated: 2026-11-07 18:06 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/116xxx/CVE-2026-116621.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-07 07:17:02 UTC
NVD last modified: 2026-11-07 18:17:12 UTC
NVD CVSS v3.1: 6.4 / 10 MEDIUM source: security@wordfence.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Exploitability subscore: 3.1 / 10
Impact subscore: 2.7 / 10
EPSS score: 0.0020 (probability of exploitation in next 30 days)
EPSS percentile: 10.05% vs all CVEs — higher = more likely to be exploited, as of 2026-11-07

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-118962

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
ultimatemember	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (7)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.2 security@wordfence.com
https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/assets/js/um-functions.js#L535 security@wordfence.com
https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/assets/js/um-profile.js#L32 security@wordfence.com
https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-fields.php#L4564 security@wordfence.com
https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-form.php#L841 security@wordfence.com
https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L847 security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/50b7a6e0-3c25-4eda-acbd-43643a291bca?source=cve security@wordfence.com

Remediations (10)

RHSB-2026-013 Request handling memory corruption - php (CVE-2026-109618 ...

web:access.redhat.com

Keep this setting in place until the updates are applied. For CVE - 2026 -115560 alone, upstream expects a fix in the next routine PHP release. Remove the Controllable Memory Limit Addresses CVE - 2026 -109618. Not required on Red Hat Enterprise Linux 7, which is not affected by this flaw. Warning: This removes PHP's own memory ceiling.

2026-11-08 11:46 UTC
CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-08 11:46 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

In this library you will find the following security documents that have been released by the Microsoft Security Response Center (MSRC). The MSRC investigates all reports of security vulnerabilities affecting Microsoft products and services, and releases these documents as part of the ongoing effort ...

2026-11-08 11:46 UTC
Microsoft Patch Tracker (October 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-11-08 11:46 UTC
SAP Security Patch Day - October 2026

web:support.sap.com

On 13 th of October 2026 , SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

2026-11-08 11:46 UTC
PHP2Shell: The Emergency PHP Patch Is Out - techaeris.com

web:techaeris.com

PHP2Shell, the two critical PHP remote code execution flaws leaked a day early, now has an emergency patch . Here is what shipped, what is still exposed, and what to do.

2026-11-08 11:46 UTC
Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade ...

web:techcommunity.microsoft.com

Learn more: Azure WAF custom rules for PHP2Shell mitigation . Request-side signals alone may not be sufficient to reliably identify certain exploitation attempts. Signals in the server response can provide additional evidence that malicious activity has occurred, enabling more targeted mitigation with higher confidence and lower false positives.

2026-11-08 11:46 UTC
Pre-Authentication Authorization Bypass and Command Injection ...

web:trust.barracuda.com

Barracuda immediately initiated a comprehensive remediation process and released security patches for affected products. Customers should review the affected products and remediation guidance below, ensure their systems are running the latest firmware version, and have all security patches applied.

2026-11-08 11:46 UTC
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-11-08 11:46 UTC
CVE-2026-16621: PayPal WooCommerce Auth Bypass Vulnerability - SentinelOne

web:www.sentinelone.com

CVE - 2026 -16621 is an authentication bypass vulnerability in PayPal for WooCommerce plugin. Learn about its impact, affected versions, and mitigation methods.

2026-11-08 11:46 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-116621.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:01:34.672810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:06.029Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin",
          "vendor": "ultimatemember",
          "versions": [
            {
              "lessThanOrEqual": "2.14.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_note (any custom Textarea metakey with html disabled)' parameter in all versions up to, and including, 2.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged victim to click the attacker-rendered anchor on the target profile page, which triggers the DOM gadget that concatenates the unescaped data-src value into an HTML string passed to jQuery."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T06:39:35.881Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/50b7a6e0-3c25-4eda-acbd-43643a291bca?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/assets/js/um-functions.js#L535"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/assets/js/um-profile.js#L32"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-fields.php#L4564"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/um-filters-fields.php#L847"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/tags/2.14.0/includes/core/class-form.php#L841"
        },
        {
          "url": "https://github.com/ultimatemember/ultimatemember/releases/tag/2.14.2"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-26T17:40:51.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T18:19:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-116621",
    "datePublished": "2026-11-07T06:39:35.881Z",
    "dateReserved": "2026-10-26T17:21:54.318Z",
    "dateUpdated": "2026-11-07T18:06:06.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}