{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15064", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-23T21:58:02.545Z", "datePublished": "2026-04-04T07:41:56.920Z", "dateUpdated": "2026-04-08T16:43:29.923Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:29.923Z"}, "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}], "title": "Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}, {"url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "timeline": [{"time": "2025-12-20T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-23T22:14:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-03T19:29:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T16:48:43.622410Z", "id": "CVE-2025-15064", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:49:00.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T16:48:43.622410Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:48:50.045Z"}}], "cna": {"title": "Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets", "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.11.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-20T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-23T22:14:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-03T19:29:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}, {"url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-04T07:41:56.920Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15064", "state": "PUBLISHED", "dateUpdated": "2026-04-06T16:49:00.991Z", "dateReserved": "2025-12-23T21:58:02.545Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-04T07:41:56.920Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}], "id": "CVE-2025-15064", "lastModified": "2026-04-07T13:20:55.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-04T08:16:05.543", "references": [{"source": "security@wordfence.com", "url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "source": "cna", "vendor": "ultimatemember"}, "product": "ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "vendor": "ultimatemember"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-04T11:51:49.376852+00:00", "value": {"mitigation_remediation": ["Upgrade Ultimate Member to version 2.11.2 or later to apply the fixed input validation and output escaping.", "If an update is not immediately possible, disable the \"HTML support for user description\" setting to prevent script injection.", "Limit or remove subscriber\u2011level access for accounts that do not require it until the plugin can be updated.", "Verify that the plugin\u2019s database entries for user descriptions are sanitized or cleared of script tags before displaying them."], "summary": {"action": "Apply Patch", "impact": "Stored cross\u2011site scripting via user description field for authenticated users with subscriber\u2011level or higher access."}, "threat_synthesis": {"affected_systems": "WordPress sites using Ultimate Member plugin version 2.11.1 or earlier, with the HTML support for user description setting enabled. Any user account with subscriber or higher role can exploit the vulnerability.", "description_and_impact": "The vulnerability resides in the user description field of the Ultimate Member plugin for WordPress. Insufficient input sanitization and output escaping allow an authenticated attacker with subscriber\u2011level or higher access to embed arbitrary JavaScript into a user profile. When other users view that profile, the script runs in their browsers, potentially allowing cookie theft, defacement, or redirection. This flaw is a classic stored cross\u2011site scripting (CWE\u201179) issue.", "risk_and_exploitability": "The CVSS base score of 6.4 reflects moderate severity. No EPSS score is available and the flaw is not in CISA KEV. Exploitation requires valid credentials and subscriber\u2011level access; the attacker must edit a profile description field with malicious code, and the script executes upon subsequent profile visits. The attack vector is authentication\u2011based; mitigation hinges on disabling the feature or applying the patch."}}}}, "created": "2026-04-06T20:27:43.849083+00:00", "updated": "2026-04-06T22:21:02.830314+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}