CVE-2026-11766: 
WordPress vulnerability analysis and mitigation

CVE-2026-11766 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member WordPress plugin affecting all versions before 2.12.0. The flaw allows authenticated users with Subscriber-level access or above to inject malicious JavaScript into custom textarea profile fields, which then executes in the browser of any user — including administrators — who views the affected profile. The vulnerability was publicly disclosed on June 15, 2026, and a patch was released on July 6, 2026. It carries a CVSS v3.1 base score of 8.0 (High) (WPScan, GitHub Advisory).

The root cause is improper output sanitization (CWE-79) in the rendering of custom textarea profile fields. The plugin applies sanitize_textarea_field() on input, which does not strip HTML entities, and then on output runs wp_kses($value, 'strip') followed by html_entity_decode($value) before echoing the result without escaping. This means an attacker can submit HTML-entity-encoded payloads (e.g., <img src=x onerror=alert(document.domain)>) that pass the input sanitizer unchanged, are stored in the database, and are then decoded back into live HTML at render time. The dedicated "Biography" field is not affected because it uses esc_html() for output; only custom textarea fields with the "HTML" option disabled are vulnerable. The original researcher and submitter is Meher Sudhakar Abbireddi (WPScan).

Successful exploitation allows a low-privileged authenticated user (Subscriber role) to store malicious JavaScript that executes in the browsers of all site visitors, including administrators, who view the compromised profile. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and full site compromise. The confidentiality, integrity, and availability impacts are all rated High, reflecting the potential for complete takeover of the WordPress site if an administrator's session is hijacked (GitHub Advisory, WPScan).

1. Reconnaissance: Identify WordPress sites running the Ultimate Member plugin in a version prior to 2.12.0. Confirm that the site's profile form includes a custom textarea field with the "HTML" option disabled (e.g., an "About Me" field with meta key aboutme), which is a common default configuration.
2. Account creation: Register or obtain a Subscriber-level account on the target WordPress site (registration is often open on sites using Ultimate Member for community features).
3. Craft the payload: Prepare an HTML-entity-encoded XSS payload that bypasses sanitize_textarea_field(), for example: <img src=x onerror=alert(document.domain)> (or a more malicious payload targeting cookie theft or admin action execution).
4. Store the payload: Log in as the Subscriber, navigate to the Ultimate Member profile edit page, enter the entity-encoded payload into the custom textarea field (e.g., "About Me"), and click "Update Profile".
5. Trigger execution: When any user (including an administrator) visits the attacker's public profile page (e.g., https://victim.example/user/subscriber/), the plugin's output filter decodes the entities back to live HTML, causing the injected script to execute in the viewer's browser.
6. Achieve objective: Use the executed JavaScript to steal session cookies, perform authenticated actions on behalf of the administrator (e.g., create a new admin account, install a backdoor plugin), or redirect the victim to a phishing page (WPScan).

• Logs: WordPress access logs showing POST requests to the Ultimate Member profile update endpoint (e.g., /wp-admin/admin-ajax.php or the profile edit URL) from low-privileged user accounts containing HTML entity sequences such as <, >, or onerror in the request body.
• Database: Unusual values in the WordPress wp_usermeta table for custom textarea meta keys (e.g., aboutme) containing HTML entity-encoded strings like <script>, <img, or onerror=.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from page loads of Ultimate Member profile pages.
• File System: Unexpected new WordPress admin accounts or newly installed/activated plugins following administrator profile views, which may indicate successful session hijacking via the XSS payload (WPScan).

The vendor has released Ultimate Member version 2.12.0, which fixes the improper output sanitization in custom textarea profile fields. All site administrators should update the plugin to version 2.12.0 or later immediately. As an interim measure, administrators should audit the wp_usermeta table for suspicious HTML entity-encoded content in custom textarea fields and remove any malicious payloads. Restricting open user registration or requiring approval for new accounts can reduce the attack surface until patching is complete (WPScan, GitHub Advisory).