CVE-2025-15064

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15064", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-23T21:58:02.545Z", "datePublished": "2026-04-04T07:41:56.920Z", "dateUpdated": "2026-04-08T16:43:29.923Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:29.923Z"}, "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}], "title": "Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}, {"url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "timeline": [{"time": "2025-12-20T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-23T22:14:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-03T19:29:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T16:48:43.622410Z", "id": "CVE-2025-15064", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:49:00.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15064", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T16:48:43.622410Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T16:48:50.045Z"}}], "cna": {"title": "Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets", "credits": [{"lang": "en", "type": "finder", "value": "Kevin Wydler"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.11.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-20T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-23T22:14:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-03T19:29:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}, {"url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:29.923Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15064", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:29.923Z", "dateReserved": "2025-12-23T21:58:02.545Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-04T07:41:56.920Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "vendor": "ultimatemember", "versions": [{"lessThanOrEqual": "2.11.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when \"HTML support for user description\" is enabled in Ultimate Member settings."}, {"lang": "es", "value": "El plugin Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del campo de descripci\u00f3n del usuario en todas las versiones hasta la 2.11.1, inclusive, debido a la sanitizaci\u00f3n de entrada y el escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La vulnerabilidad solo es explotable cuando 'soporte HTML para la descripci\u00f3n del usuario' est\u00e1 habilitado en la configuraci\u00f3n de Ultimate Member."}], "id": "CVE-2025-15064", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15064", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T16:48:43.622410Z", "version": "2.0.3"}}]}, "published": "2026-04-04T08:16:05.543", "references": [{"source": "security@wordfence.com", "url": "https://github.com/ultimatemember/ultimatemember/pull/1774"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a7f070a-b67c-4e65-a928-a6116266c54d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "source": "cna", "vendor": "ultimatemember"}, "product": "ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "vendor": "ultimatemember"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-04T11:51:49.376852+00:00", "value": {"mitigation_remediation": ["Upgrade Ultimate Member to version 2.11.2 or later to apply the fixed input validation and output escaping.", "If an update is not immediately possible, disable the \"HTML support for user description\" setting to prevent script injection.", "Limit or remove subscriber\u2011level access for accounts that do not require it until the plugin can be updated.", "Verify that the plugin\u2019s database entries for user descriptions are sanitized or cleared of script tags before displaying them."], "summary": {"action": "Apply Patch", "impact": "Stored cross\u2011site scripting via user description field for authenticated users with subscriber\u2011level or higher access."}, "threat_synthesis": {"affected_systems": "WordPress sites using Ultimate Member plugin version 2.11.1 or earlier, with the HTML support for user description setting enabled. Any user account with subscriber or higher role can exploit the vulnerability.", "description_and_impact": "The vulnerability resides in the user description field of the Ultimate Member plugin for WordPress. Insufficient input sanitization and output escaping allow an authenticated attacker with subscriber\u2011level or higher access to embed arbitrary JavaScript into a user profile. When other users view that profile, the script runs in their browsers, potentially allowing cookie theft, defacement, or redirection. This flaw is a classic stored cross\u2011site scripting (CWE\u201179) issue.", "risk_and_exploitability": "The CVSS base score of 6.4 reflects moderate severity. No EPSS score is available and the flaw is not in CISA KEV. Exploitation requires valid credentials and subscriber\u2011level access; the attacker must edit a profile description field with malicious code, and the script executes upon subsequent profile visits. The attack vector is authentication\u2011based; mitigation hinges on disabling the feature or applying the patch."}}}}, "created": "2026-04-06T20:27:43.849083+00:00", "updated": "2026-04-06T22:21:02.830314+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}