CVE-2026-96270 Overview
CVE-2026-96270 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member plugin for WordPress, affecting all versions up to and including 2.13.1. The flaw resides in the handling of the form_id parameter during user registration. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary JavaScript that is stored in the registering user's submitted usermeta. The payload executes when a WordPress administrator opens the affected user record in the wp-admin Users modal. This vulnerability is tracked as CWE-79.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in an administrator's browser session, enabling account takeover, privilege escalation, and backend compromise.
Affected Products
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress
- All versions up to and including 2.13.1
- Fixed in version 2.14.0
Discovery Timeline
- 2026-10-03 - CVE-2026-96270 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-96270
Vulnerability Analysis
The Ultimate Member plugin accepts a form_id parameter during the registration workflow without applying adequate sanitization. The submitted value is persisted via WordPress's update_user_meta() function into the user's submitted usermeta field. When an administrator later opens the user record in the wp-admin Users modal, the stored value is rendered into the DOM through jQuery's .html() method without escaping. This produces a classic stored XSS condition in a privileged UI context. See the Wordfence Vulnerability Report for additional analysis.
Root Cause
The root cause is a combination of missing input sanitization at the registration intake path and missing output escaping at the admin-side render path. The plugin trusts attacker-controlled form_id content and later passes the stored value to jQuery .html(), which parses and executes any embedded <script> or event-handler payload. Relevant code paths exist in class-form.php line 422, class-form.php line 768, and class-admin-builder.php line 1090.
Attack Vector
An unauthenticated attacker submits a crafted registration request to a vulnerable WordPress site, placing a JavaScript payload in the form_id field. The payload is written to the new user's submitted usermeta. When any administrator subsequently reviews pending or existing users through the wp-admin Users modal, the payload executes in the administrator's authenticated session. This allows actions such as creating new administrator accounts, modifying plugins, or exfiltrating session data. Additional sinks appear in class-user.php line 1447 and um-short-functions.php line 900.
Detection Methods for CVE-2026-96270
Indicators of Compromise
- Unexpected administrator-level user accounts created shortly after a legitimate admin viewed the Users modal.
- wp_usermeta rows where meta_key = 'submitted' contain HTML tags, <script>, onerror=, or javascript: substrings.
- Registration POST requests containing HTML or JavaScript tokens in the form_id field in web server access logs.
- Modifications to plugin files, themes, or wp-config.php with no corresponding administrator change ticket.
Detection Strategies
- Query wp_usermeta for the submitted key and inspect serialized values for script content or encoded payloads.
- Review web application firewall (WAF) and reverse-proxy logs for registration requests containing <, >, or encoded script markers in form_id.
- Audit WordPress role changes and new user creation events in the wp_users and wp_usermeta tables.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress installation directory, including wp-content/plugins/ultimate-member/.
- Forward WordPress audit logs and web server logs to a centralized analytics platform for correlation and alerting.
- Alert on anomalous administrator session behavior such as plugin installation or user role changes outside of expected maintenance windows.
How to Mitigate CVE-2026-96270
Immediate Actions Required
- Upgrade the Ultimate Member plugin to version 2.14.0 or later on all WordPress sites.
- Audit the wp_usermeta table for malicious payloads in the submitted field and purge affected rows.
- Review all administrator accounts and remove any that were not provisioned through authorized processes.
- Rotate administrator passwords and invalidate active WordPress sessions after remediation.
Patch Information
The vendor addressed the vulnerability in Ultimate Member version 2.14.0. The patch adds proper input sanitization for the form_id parameter and escapes output rendered through the wp-admin Users modal. Site operators should apply this update through the WordPress plugin manager or by deploying the released package directly.
Workarounds
- Temporarily disable the Ultimate Member plugin on sites that cannot immediately upgrade to 2.14.0.
- Disable open user registration in WordPress settings to block unauthenticated submission of the vulnerable parameter.
- Deploy WAF rules that reject registration requests containing HTML or JavaScript tokens in the form_id field.
- Restrict wp-admin access to known IP ranges using web server or network ACLs until the patch is applied.
# Example WP-CLI commands to update the plugin and audit affected usermeta
wp plugin update ultimate-member --version=2.14.0
wp db query "SELECT user_id, meta_value FROM wp_usermeta WHERE meta_key='submitted' AND meta_value LIKE '%<script%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
