CVE-2026-1404

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1404", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-24T01:06:30.523Z", "datePublished": "2026-02-18T14:24:59.371Z", "dateUpdated": "2026-04-08T17:18:13.656Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:13.656Z"}, "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/templates/members.php#L348"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/assets/js/um-members.js#L515"}, {"url": "https://plugins.trac.wordpress.org/changeset/3458086/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2026-01-24T01:23:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T14:44:25.638272Z", "id": "CVE-2026-1404", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:44:53.910Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1404", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T14:44:25.638272Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:44:46.924Z"}}], "cna": {"title": "Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimatemember", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.11.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-24T01:23:49.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-17T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/templates/members.php#L348"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/assets/js/um-members.js#L515"}, {"url": "https://plugins.trac.wordpress.org/changeset/3458086/"}], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-18T14:24:59.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1404", "state": "PUBLISHED", "dateUpdated": "2026-02-18T14:44:53.910Z", "dateReserved": "2026-01-24T01:06:30.523Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T14:24:59.371Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "vendor": "ultimatemember", "versions": [{"lessThanOrEqual": "2.11.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction &amp; Membership Plugin para WordPress es vulnerable a cross-site scripting reflejado a trav\u00e9s de los par\u00e1metros de filtro (por ejemplo, 'filter_first_name') en todas las versiones hasta la 2.11.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a los atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2026-1404", "lastModified": "2026-06-17T10:15:43.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1404", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T14:44:25.638272Z", "version": "2.0.3"}}]}, "published": "2026-02-18T15:18:40.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/assets/js/um-members.js#L515"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/templates/members.php#L348"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3458086/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba62b804-f101-4e29-8304-fb2b7dad333c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Ultimate Member \u2013 User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "source": "cna", "vendor": "ultimatemember"}, "product": "ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "vendor": "ultimatemember"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:04:32.997153+00:00", "value": {"mitigation_remediation": ["Update the Ultimate Member plugin to the latest available version that incorporates the XSS fix, currently 2.12 or newer.", "If an immediate upgrade is not possible, implement a server\u2011side sanitization routine that applies wp_kses or sanitize_text_field to all filter parameters before they are output in the page.", "Deploy a Web Application Firewall rule that blocks or neutralizes script tags in query parameters and enable a restrictive Content Security Policy that disallows inline scripts, thereby mitigating accidental execution of injected payloads."], "summary": {"action": "Patch immediately", "impact": "Reflected Cross-Site Scripting that allows unauthenticated attackers to inject arbitrary scripts into pages, potentially stealing credentials or defacing content"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Ultimate Member plugin in any release up to and including version 2.11.1 are affected. The issue impacts the plugin\u2019s filter functionality accessible through public URLs, allowing attackers to inject payloads via query string parameters.", "description_and_impact": "The flaw resides in the handling of filter parameters such as 'filter_first_name' in the Ultimate Member plugin for WordPress; user input is not properly escaped when rendered in page responses. An attacker can craft a link that includes malicious script payloads, which will be executed in the victim's browser when the link is followed, enabling cookie theft, session hijacking, or site defacement. The vulnerability is a classic reflected XSS and is executed in the context of any authenticated or unauthenticated visitor who follows the malicious URL.", "risk_and_exploitability": "The CVSS score of 6.1 classifies the vulnerability as moderate; the EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not presently tracked in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to entice a victim to click a specially crafted link containing malicious script in a filter parameter \u2013 a social engineering vector that is feasible but not trivial. Because the attack does not require privileged access or pre-existing credentials, the potential impact on confidentiality, integrity, and availability remains significant if an attacker succeeds."}}}}, "created": "2026-02-19T10:12:01.211741+00:00", "updated": "2026-04-15T17:30:10.428240+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$ultimate_member_\u2013_user_profile,_registration,_login,_member_directory,_content_restriction_&_membership_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}