CVE-2025-13217

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13217", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-14T20:12:30.355Z", "datePublished": "2025-12-17T18:21:34.878Z", "dateUpdated": "2026-04-08T17:05:07.971Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:07.971Z"}, "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping on user-supplied YouTube video URLs in the `um_profile_field_filter_hook__youtube_video()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the injected user's profile page."}], "title": "Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/um-filters-fields.php#L80"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421362/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "timeline": [{"time": "2025-12-04T08:28:04.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T18:52:09.363871Z", "id": "CVE-2025-13217", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T19:29:16.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13217", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T18:52:09.363871Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T18:52:11.883Z"}}], "cna": {"title": "Ultimate Member <= 2.11.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'value'", "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.11.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T08:28:04.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/um-filters-fields.php#L80"}, {"url": "https://plugins.trac.wordpress.org/changeset/3421362/"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping on user-supplied YouTube video URLs in the `um_profile_field_filter_hook__youtube_video()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the injected user's profile page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-17T18:21:34.878Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13217", "state": "PUBLISHED", "dateUpdated": "2025-12-17T19:29:16.718Z", "dateReserved": "2025-11-14T20:12:30.355Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-17T18:21:34.878Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "vendor": "ultimatemember", "versions": [{"lessThanOrEqual": "2.11.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input sanitization and output escaping on user-supplied YouTube video URLs in the `um_profile_field_filter_hook__youtube_video()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the injected user's profile page."}], "id": "CVE-2025-13217", "lastModified": "2026-06-17T08:33:42.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13217", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-17T18:52:09.363871Z", "version": "2.0.3"}}]}, "published": "2025-12-17T19:16:00.690", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/um-filters-fields.php#L80"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3421362/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/876b57e0-cf1e-4ce9-ba85-a5d4554797bd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:01:38.986594+00:00", "value": {"mitigation_remediation": ["Update Ultimate Member to version 2.11.1 or later, which sanitizes YouTube URLs and applies proper output escaping.", "If an immediate update is not feasible, disable the YouTube video field in the plugin settings or restrict the field to accept only plain, validated URLs, thereby preventing script injection.", "Examine all existing user profiles for suspicious YouTube URLs and remove or clean any that contain script tags or unexpected characters.", "Consider implementing a site\u2011wide Content Security Policy that blocks inline scripts to provide an additional layer of defense against stored XSS."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross-Site Scripting allowing malicious scripts to execute in profile pages viewed by other users"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress. All releases up to and including version 2.11.0 are impacted. Users running these plugin versions on any WordPress site are susceptible, regardless of WordPress core version.", "description_and_impact": "A stored XSS flaw resides in the YouTube Video \"value\" field of the Ultimate Member WordPress plugin. When an authenticated user with Subscriber-level access or higher edits the field to contain a malicious script, the input is saved without proper sanitization or escaping. Any user who views that profile page receives the injected script in their browser, enabling attackers to steal session cookies, deface content, or perform phishing attacks directly from the profile view.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows the likelihood of exploitation is very low at the time of analysis. The flaw is not catalogued in the CISA KEV list. Exploitation requires an authenticated session with at least Subscriber privileges and interaction with the profile editing interface. Once the malicious input is stored, it propagates to any visitor of the profile page, making the attack vector internal but lateral to other users\u2019 browsers."}}}}, "created": "2025-12-18T09:57:01.045931+00:00", "updated": "2026-04-21T17:15:25.322553+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$ultimatemember", "wordpress", "wordpress$PRODUCT$wordpress"]}