CVE-2025-13220 Overview
CVE-2025-13220 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member plugin for WordPress. The plugin provides user profile, registration, login, member directory, content restriction, and membership features. All versions up to and including 2.11.0 are affected. The flaw resides in the plugin's shortcode attribute handling, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who accesses an affected page. The vulnerability is tracked under [CWE-79] and carries a scope-changed impact due to shortcode execution across post contexts.
Critical Impact
Authenticated Contributor-level attackers can inject persistent JavaScript that executes against site visitors, enabling session theft, forced administrative actions, and content defacement.
Affected Products
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress
- All plugin versions up to and including 2.11.0
- WordPress sites permitting Contributor-level user registration
Discovery Timeline
- 2025-12-21 - CVE-2025-13220 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13220
Vulnerability Analysis
The vulnerability is a stored XSS flaw categorized under [CWE-79]. The Ultimate Member plugin registers shortcodes that accept user-supplied attributes and render them within page output. The shortcode handler in includes/core/class-shortcodes.php fails to sanitize incoming attribute values and does not escape them prior to emission in HTML context. An authenticated Contributor can embed a malicious shortcode inside a post or page. When the post is rendered, the injected payload executes in the browser of every viewer, including administrators. Because shortcodes are processed during content rendering, the resulting scope is changed relative to the vulnerable component, expanding the reach of a successful injection.
Root Cause
The root cause is missing input sanitization on shortcode attributes and missing output escaping when those attributes are echoed back into rendered HTML. The vulnerable logic is present at multiple locations in class-shortcodes.php, including lines referenced as L67, L525, L542, L558, L591, and L625 in the 2.10.6 tag. The plugin trusts attribute values as safe strings and inserts them directly into the DOM without contextual escaping such as esc_attr() or wp_kses().
Attack Vector
An authenticated user with Contributor-level access or above authors a post that includes a vulnerable Ultimate Member shortcode. The attacker sets an attribute value to a JavaScript payload, for example an event handler or a <script> fragment. When the post is previewed, published, or visited by another user, the plugin renders the attribute into the page unescaped and the payload executes in the visitor's browser session. This enables cookie theft, forced actions via the WordPress REST API, and privilege escalation if an administrator views the malicious content.
No verified public exploit code is available. See the Wordfence Vulnerability Report and the Ultimate Member Changeset History for technical details.
Detection Methods for CVE-2025-13220
Indicators of Compromise
- Posts or pages authored by Contributor-level accounts containing Ultimate Member shortcodes with attribute values embedding <script>, onerror=, onload=, javascript:, or encoded equivalents.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains following visits to plugin-rendered pages.
- New or modified WordPress users, options, or plugin installations correlated with an administrator visiting a Contributor-authored page.
Detection Strategies
- Audit post content in wp_posts for Ultimate Member shortcodes with suspicious attribute values using SQL queries against post_content.
- Review web server logs for anomalous parameter values submitted by Contributor accounts to post.php and admin-ajax.php.
- Deploy a Web Application Firewall (WAF) rule set that inspects shortcode attribute contents for HTML tag or event handler patterns.
Monitoring Recommendations
- Monitor creation and editing of posts by low-privilege roles, especially newly registered Contributor accounts.
- Alert on administrator sessions that generate REST API activity immediately after viewing a Contributor-authored page.
- Track plugin version inventory across WordPress sites and flag any installation still running Ultimate Member 2.11.0 or earlier.
How to Mitigate CVE-2025-13220
Immediate Actions Required
- Update the Ultimate Member plugin to a version later than 2.11.0 that contains the fix referenced in the plugin changeset.
- Audit existing posts and pages for malicious Ultimate Member shortcode attributes and remove any injected payloads.
- Review the Contributor role assignments and revoke access for accounts that do not require content authoring.
Patch Information
The vendor released a fix tracked in the Ultimate Member Changeset History. The fix introduces sanitization and escaping for shortcode attributes in includes/core/class-shortcodes.php. Site administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Confirm the installed version is greater than 2.11.0 after upgrade.
Workarounds
- Temporarily restrict the Contributor role from using the affected Ultimate Member shortcodes by filtering do_shortcode output for low-privilege authors.
- Deploy a WAF rule that blocks HTML tags and JavaScript event handlers inside shortcode attribute values submitted through post editing endpoints.
- Disable the Ultimate Member plugin until the patched version is deployed if the site does not depend on member directory features.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
