CVE-2026-18547: Ultimate Member WordPress Plugin XSS Vulnerability

CVE-2026-18547 Overview

CVE-2026-18547 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Ultimate Member WordPress plugin. The flaw affects all versions up to and including 2.12.1. Authenticated attackers with subscriber-level access or above can inject arbitrary JavaScript through a Textarea Profile Field that supports HTML. The injected payload executes when any user loads an affected profile page, because pickadate.js concatenates the stored id attribute into an HTML string via jQuery .html().

Critical Impact
A low-privileged authenticated user can persist JavaScript on WordPress profile pages, executing in the browsers of visitors and administrators, enabling session theft, account takeover, and further site compromise.

Affected Products

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress
All versions from initial release through 2.12.1
WordPress sites permitting subscriber-level (or higher) registration with profile editing

Discovery Timeline

2026-08-25 - CVE-2026-18547 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18547

Vulnerability Analysis

The vulnerability resides in how Ultimate Member sanitizes and later renders profile field content. The plugin uses a wp_kses allowlist referred to as templates, which permits the id attribute on <div> elements. The allowlist does not neutralize unescaped quotes inside the attribute value, allowing attackers to smuggle additional attribute syntax through the sanitization stage.

During profile page load, pickadate.js reads the stored id value and concatenates it into an HTML string, which jQuery .html() then parses. This client-side re-parsing converts what was persisted as an attribute value back into live HTML. Attributes such as onfocus combined with autofocus execute JavaScript in the context of the viewing user, including administrators.

Root Cause

The root cause is insufficient input sanitization and output escaping in a wp_kses allowlist that treats attribute values as opaque strings. Because the plugin later hands stored content to a client-side templating flow that re-parses it as HTML, server-side sanitization alone is insufficient. The combination creates a DOM gadget: sanitized markup on the server becomes executable JavaScript in the browser.

Attack Vector

Exploitation requires an authenticated account with subscriber privileges or higher. The attacker edits a Textarea Profile Field that supports HTML and inserts a <div> element whose id attribute contains crafted quote characters followed by onfocus and autofocus syntax. When any visitor loads a page that renders the profile field through pickadate.js, the payload executes in the visitor's browser. Refer to the Wordfence Vulnerability Analysis for further technical details.

Detection Methods for CVE-2026-18547

Indicators of Compromise

Profile field values in wp_usermeta containing <div> markup with unescaped quotes inside id attributes.
Presence of autofocus or event-handler attributes such as onfocus, onerror, or onload in stored profile content.
Unexpected outbound requests from administrator browsers immediately after viewing a member profile page.
New WordPress administrator accounts or modified user roles created shortly after profile page views.

Detection Strategies

Query the WordPress user meta table for Ultimate Member profile fields containing <, >, onfocus, or autofocus substrings.
Inspect HTTP response bodies for profile pages to identify inline event handlers within <div> elements rendered by Ultimate Member.
Correlate subscriber registration events with subsequent profile edits containing HTML markup as a behavioral signal.

Monitoring Recommendations

Enable WordPress audit logging for user meta updates and profile field changes.
Monitor web server logs for POST requests to Ultimate Member profile update endpoints originating from newly registered accounts.
Track Content Security Policy (CSP) violation reports for script-src and inline handler violations on profile pages.

How to Mitigate CVE-2026-18547

Immediate Actions Required

Update the Ultimate Member plugin to a version later than 2.12.1 that includes the fix from Ultimate Member Changeset #3663931.
Audit existing profile field data for stored HTML payloads and sanitize or remove suspect entries.
Review WordPress administrator and editor accounts for unauthorized additions or role changes.
Rotate session cookies and force reauthentication for privileged users after remediation.

Patch Information

The vendor addressed the vulnerability in the Ultimate Member plugin repository. The relevant source files are assets/js/common.js, includes/class-functions.php, and includes/core/class-form.php. See the Ultimate Member Class Form Implementation and the Ultimate Member Changeset #3663931 for the corrective changes.

Workarounds

Restrict new user registration or set the default role below subscriber where possible.
Disable HTML support on Textarea Profile Fields until the plugin is patched.
Deploy a Web Application Firewall (WAF) rule to block profile update payloads containing onfocus, autofocus, or unescaped quotes inside id attributes.
Apply a strict Content Security Policy that disallows inline event handlers on pages rendering Ultimate Member profiles.

bash

# Example WordPress CLI commands to identify and mitigate exposure
wp plugin update ultimate-member
wp user list --role=subscriber --field=ID | \
  xargs -I {} wp user meta list {} --format=csv | grep -Ei 'onfocus|autofocus|<div'