Ultimate Member Plugin Stored XSS in Textarea Fields

The Ultimate Member WordPress plugin before version 2.12.0 contains a stored cross-site scripting (XSS) vulnerability in custom textarea profile fields. The plugin fails to properly sanitize and escape user-supplied content before rendering it on profile pages, enabling authenticated attackers with Subscriber-level permissions or higher to inject malicious JavaScript. When any user—including administrators with elevated privileges—views an affected profile, the injected script executes in their browser context. This is particularly dangerous because attackers can steal session cookies, harvest credentials, redirect users to phishing sites, or perform administrative actions on behalf of compromised users. Any WordPress installation using Ultimate Member is potentially affected if custom textarea fields are configured, making this a significant risk for community-driven sites, membership platforms, and organizations using this plugin for user management.

Casky's Claude AI-powered analysis would identify this vulnerability by mapping it to MITRE ATT&CK techniques including T1059 (Command and Scripting Interpreter) and T1566 (Phishing) patterns, detecting the characteristic signatures of stored XSS attacks. Practitioners using Casky would see findings related to insufficient input validation (CWE-79 class behaviors), improper output encoding during profile rendering, and privilege escalation pathways where low-privilege users can impact high-privilege accounts. The extended reasoning capability would correlate suspicious profile field modifications with subsequent script execution events, revealing the attack chain from injection point to payload execution. Security teams would receive actionable alerts highlighting the need to update the plugin, implement content security policies, and audit existing profile fields for injected content—moving beyond signature-based detection to understand the business logic flaws enabling the attack.