An unauthenticated stored Cross-Site Scripting vulnerability in the Ultimate Member WordPress plugin allows remote attackers to execute arbitrary JavaScript in the context of other users, including administrators.

This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) triggered by improper escaping of user-supplied profile names. Unauthenticated attackers can register an account and inject malicious JavaScript that executes when a site visitor or administrator views the compromised profile.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for impact. Successful exploitation can lead to full account takeover of administrative accounts, unauthorized access to sensitive site data, and the potential for site-wide defacement or redirection, posing a significant risk to organizational integrity and user trust.

Immediate Action: Update the Ultimate Member plugin to version 2.13.1 or later immediately to resolve the sanitization flaw.

Proactive Monitoring: Review administrative user account logs for suspicious activities or unauthorized changes, and monitor web server access logs for unusual patterns related to profile page requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS protection rules to block malicious script injections targeting profile fields while the update is being staged.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for administrative account compromise, this vulnerability poses a severe risk to WordPress environments. Security teams should prioritize updating the Ultimate Member plugin to version 2.13.1 across all instances. If an immediate update is not feasible, consider disabling public user registration or restricting profile access until the patch is successfully applied.