PULSE
LIVE21signals / 24h
ES
FEED
ransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Servicesransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Services
← All CVEs
CVE WatchJul 6, 2026

CVE-2026-11766

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before

CVSS

8.0

High

EPSS

0.2%

p16

KEV

—

Exploit Today

5

0-100

Published: Jul 6, 2026 · Last modified: Jul 6, 2026

EPSS · 30d
0.2%EPSS · 30 days0.2%
2026-07-062026-07-21
Technical description

The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

Official references
Related CVEs

No related CVEs by CWE or product.