CVE-2026-11766

8.0 Élevée

Publiée le 06/07/2026 à 10:16 · Modifiée le 06/07/2026 à 20:37 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

Traduire en français

Produits concernés

Unknown Ultimate Member

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.0 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

Références

https://wpscan.com/vulnerability/96adb2d3-af34-4455-97d4-90af58049e78/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories